| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| ci4-cms-erp/ci4ms | < 0.31.0.0 | 0.31.0.0 |
| ci4ms | < 0.31.0.0 | 0.31.0.0 |
The application fails to properly sanitize user-controlled input when creating or editing blog posts within the Categories section. An attacker can inject a malicious JavaScript payload into the Categories content, which is then stored server-side.
This stored payload is later rendered unsafely when the Categories are viewed via blog posts, without proper output encoding, leading to stored cross-site scripting (XSS).
Endpoints:
/backend/blogs/create (Categories specific)/backend/blogs/ (Categories view)/blog/{id} (Rendered blog post under Categories)Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí<img src=x onerror=alert(document.domain)>Avoid unsafe DOM manipulation methods: Do not use .html(), innerHTML, or similar sink functions in client-side JavaScript or server-side templating (e.g., PHP). Even when user input flowing into these sinks is not immediately apparent, they can introduce Cross-Site Scripting (XSS) vulnerabilities that an attacker may exploit.
Apply output encoding: Implement HTML entity encoding on all user-controlled data before rendering it in the browser. This helps neutralize potentially malicious input.
Implement input sanitization: Ensure that all user-supplied input is properly sanitized before processing or output. Currently, no sanitization mechanisms are in place, which should be addressed as a priority.
Enforce security headers and cookie attributes:
HttpOnly attribute on session cookies to prevent client-side script access.SameSite cookie attribute to mitigate Cross-Site Request Forgery (CSRF) risks.Secure attribute.These measures collectively reduce the impact of XSS and help prevent escalation paths such as CSRF via XSS.