CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application renders user-controlled input unsafely within the logs interface. If any stored XSS payload exists within logged data, it is rendered without proper output encoding. This issue becomes a Blind XSS scenario because the attacker does not see immediate execution. Instead, the payload is stored within application logs and only executes later when an administrator views the logs page. This issue has been patched in version 0.31.0.0.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

CI4MS 跨站脚本漏洞

CI4MS是Ci4MS开源的一个博客页面管理工具。 CI4MS 0.31.0.0之前版本存在跨站脚本漏洞，该漏洞源于应用程序在日志界面中不安全地渲染用户控制的输入，如果日志数据中存在任何存储型跨站脚本有效载荷，它将在没有适当输出编码的情况下被渲染，导致盲跨站脚本攻击。

N/A

N/A