| Package | Affected versions | Patched versions |
|---|---|---|
| ci4-cms-erp/ci4ms | < 0.31.0.0 | 0.31.0.0 |
| ci4ms | < 0.31.0.0 | 0.31.0.0 |
The application fails to properly sanitize user-controlled input within the Page Management functionality when creating or editing pages. Multiple input fields accept attacker-controlled JavaScript payloads that are stored server-side.
These stored values are later rendered without proper output encoding across administrative page lists and public-facing page views, leading to stored DOM-based cross-site scripting (XSS).
Endpoints:
/backend/pages/create<img src=x onerror=alert(document.domain)>Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeAvoid unsafe DOM manipulation methods: Do not use .html(), innerHTML, or similar sink functions in client-side JavaScript or server-side templating (e.g., PHP). Even when user input flowing into these sinks is not immediately apparent, they can introduce Cross-Site Scripting (XSS) vulnerabilities that an attacker may exploit.
Apply output encoding: Implement HTML entity encoding on all user-controlled data before rendering it in the browser. This helps neutralize potentially malicious input.
Implement input sanitization: Ensure that all user-supplied input is properly sanitized before processing or output. Currently, no sanitization mechanisms are in place, which should be addressed as a priority.
Enforce security headers and cookie attributes:
HttpOnly attribute on session cookies to prevent client-side script access.SameSite cookie attribute to mitigate Cross-Site Request Forgery (CSRF) risks.Secure attribute.These measures collectively reduce the impact of XSS and help prevent escalation paths such as CSRF via XSS.