| Package | Affected versions | Patched versions |
|---|---|---|
| ci4-cms-erp/ci4ms | < 0.31.0.0 | 0.31.0.0 |
| ci4ms | < 0.31.0.0 | 0.31.0.0 |
The application fails to properly sanitize user-controlled input when adding Posts to navigation menus through the Menu Management functionality. Post-related data selected via the Posts section is stored server-side and rendered without proper output encoding.
These stored values are later rendered unsafely within administrative dashboards and public-facing navigation menus, resulting in stored DOM-based cross-site scripting (XSS).
Endpoint:
/backend/menu/<img src=x onerror=alert(document.domain)>Avoid unsafe DOM manipulation methods: Do not use .html(), innerHTML, or similar sink functions in client-side JavaScript or server-side templating (e.g., PHP). Even when user input flowing into these sinks is not immediately apparent, they can introduce Cross-Site Scripting (XSS) vulnerabilities that an attacker may exploit.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeApply output encoding: Implement HTML entity encoding on all user-controlled data before rendering it in the browser. This helps neutralize potentially malicious input.
Implement input sanitization: Ensure that all user-supplied input is properly sanitized before processing or output. Currently, no sanitization mechanisms are in place, which should be addressed as a priority.
Enforce security headers and cookie attributes:
HttpOnly attribute on session cookies to prevent client-side script access.SameSite cookie attribute to mitigate Cross-Site Request Forgery (CSRF) risks.Secure attribute.These measures collectively reduce the impact of XSS and help prevent escalation paths such as CSRF via XSS.