Skip to content

Commit 6b73dce

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-458r-h248-29c5 GHSA-85m8-g393-jcxf GHSA-g4pp-fhgf-8653 GHSA-r33w-c82v-x5v7 GHSA-xgh5-w62m-8mpr
1 parent 2127c23 commit 6b73dce

5 files changed

Lines changed: 300 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/04/GHSA-458r-h248-29c5/GHSA-458r-h248-29c5.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-458r-h248-29c5",
4+
"modified": "2026-04-01T22:06:28Z",
5+
"published": "2026-04-01T22:06:28Z",
6+
"aliases": [
7+
"CVE-2026-34566"
8+
],
9+
"summary": "CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS",
10+
"details": "## Summary\n### **Vulnerability: Stored DOM XSS via Page Management Fields (Persistent Payload Injection)**\n- Stored Cross-Site Scripting via Unsanitized Page Creation and Editing Inputs\n\n### Description\nThe application fails to properly sanitize user-controlled input within the **Page Management** functionality when creating or editing pages. Multiple input fields accept attacker-controlled JavaScript payloads that are stored server-side.\n\nThese stored values are later rendered without proper output encoding across administrative page lists and public-facing page views, leading to stored DOM-based cross-site scripting (XSS).\n\n### Affected Functionality\n- Page creation functionality\n- Page editing functionality\n- Page list and management views\n- Public-facing page rendering\n- Storage and retrieval of page-related data\n\n### Affected Fields\n- Title\n- URL\n- Content\n- Cover Image\n- Image URL\n- Image Width\n- Image Height\n- SEO Description\n- SEO Keywords\n\n### Attack Scenario\n- An attacker creates or edits a page and injects a malicious XSS payload into one or more page-related input fields.\n- The application stores these values without sanitization or encoding.\n- The payload is rendered in administrative page lists and public-facing page views.\n- The payload executes automatically in the browser context of administrators, authenticated users, and unauthenticated visitors.\n\n### Impact\n- Persistent Stored XSS\n- Execution of arbitrary JavaScript in victims’ browsers\n- Privilege escalation when viewed by administrators or privileged users\n- Full administrator account takeover\n- Full account takeover across all roles\n- Full compromise of the entire application\n\nEndpoints:\n- `/backend/pages/create`\n- Page list management view\n- Public-facing page views\n\n## Steps To Reproduce (POC)\n1. Navigate to the Page Management -> Add Page interface\n2. Insert an XSS payload into any page-related field such as:\n`<img src=x onerror=alert(document.domain)>`\n3. Save or publish the page\n4. View the page via the administrative page list or public-facing page\n5. Observe the XSS payload executing automatically\n\n## Remediation\n\n- **Avoid unsafe DOM manipulation methods:** Do not use `.html()`, `innerHTML`, or similar sink functions in client-side JavaScript or server-side templating (e.g., PHP). Even when user input flowing into these sinks is not immediately apparent, they can introduce Cross-Site Scripting (XSS) vulnerabilities that an attacker may exploit.\n\n- **Apply output encoding:** Implement HTML entity encoding on all user-controlled data before rendering it in the browser. This helps neutralize potentially malicious input.\n\n- **Implement input sanitization:** Ensure that all user-supplied input is properly sanitized before processing or output. Currently, no sanitization mechanisms are in place, which should be addressed as a priority.\n\n- **Enforce security headers and cookie attributes:**\n - **Content Security Policy (CSP):** Define and enforce a strict CSP to limit the execution of unauthorized scripts.\n - **HttpOnly flag:** Set the `HttpOnly` attribute on session cookies to prevent client-side script access.\n - **SameSite attribute:** Configure the `SameSite` cookie attribute to mitigate Cross-Site Request Forgery (CSRF) risks.\n - **Secure flag:** Ensure all cookies are transmitted only over HTTPS by enabling the `Secure` attribute.\n\n These measures collectively reduce the impact of XSS and help prevent escalation paths such as CSRF via XSS.\n\n# Ready Video POC:\nhttps://mega.nz/file/iAkWAKQY#hCUv4DlMPFykPvb4gO94ZVGj64tpUk99gLxE6u1kASk",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "ci4-cms-erp/ci4ms"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.31.0.0"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 0.28.6.0"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-458r-h248-29c5"
45+
},
46+
{
47+
"type": "PACKAGE",
48+
"url": "https://github.com/ci4-cms-erp/ci4ms"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-79"
54+
],
55+
"severity": "CRITICAL",
56+
"github_reviewed": true,
57+
"github_reviewed_at": "2026-04-01T22:06:28Z",
58+
"nvd_published_at": null
59+
}
60+
}

‎advisories/github-reviewed/2026/04/GHSA-85m8-g393-jcxf/GHSA-85m8-g393-jcxf.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-85m8-g393-jcxf",
4+
"modified": "2026-04-01T22:04:21Z",
5+
"published": "2026-04-01T22:04:21Z",
6+
"aliases": [
7+
"CVE-2026-34563"
8+
],
9+
"summary": "CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS",
10+
"details": "## Summary\n### **Vulnerability: Stored DOM Blind XSS via Backup Management Filename (Persistent Payload Injection)**\n- Stored Cross-Site Scripting (Blind XSS) via Unsanitized Backup Filename in Backup Management\n\n### Description\nThe application fails to properly sanitize user-controlled input when handling backup uploads and processing backup metadata. An attacker can inject a malicious JavaScript payload into the backup filename via the uploaded `xss.sql`, which uses SQL functionality to insert the XSS payload server-side.\n\nThis stored payload is later rendered unsafely in multiple backup management views without proper output encoding, leading to stored blind cross-site scripting (Blind XSS).\n\n### Affected Functionality\n- Backup upload functionality\n- Backup processing functionality\n- Backup storage and retrieval logic\n\n### Attack Scenario\n- An attacker uploads `xss.sql` which uses SQL functionality to insert a malicious XSS payload into the backup filename field server-side.\n- The application stores this filename without sanitization or encoding.\n- The payload persists and executes whenever the backup filename is rendered in affected views.\n- The attacker does not see immediate execution, making this a Blind XSS scenario that triggers only when an administrator or privileged user views the backup management panel.\n\n### Impact\n- Persistent Stored Blind XSS\n- Execution of arbitrary JavaScript in victims’ browsers\n- Privilege escalation when viewed by administrators or privileged users\n- Full administrator account takeover\n- Full account takeover across all roles\n- Full compromise of the entire application\n\nEndpoints:\n- `/backend/backup/upload`\n- `/backend/backup/`\n- `/backup/{id}`\n\n## Steps To Reproduce (POC)\n1. Upload `xss.sql` via the Backup Upload functionality\n2. Ensure the SQL executes and inserts an XSS payload into the backup filename field such as:\n`<img src=x onerror=alert(document.domain)>`\n3. Navigate to the Backup Management panel as an administrator\n4. View the backup entry via the administrative panel\n5. Notice the XSS payload executing automatically (Blind XSS)\n\n## Remediation\n\n- **Avoid unsafe DOM manipulation methods:** Do not use `.html()`, `innerHTML`, or similar sink functions in client-side JavaScript or server-side templating (e.g., PHP). Even when user input flowing into these sinks is not immediately apparent, they can introduce Cross-Site Scripting (XSS) vulnerabilities that an attacker may exploit.\n\n- **Apply output encoding:** Implement HTML entity encoding on all user-controlled data before rendering it in the browser. This helps neutralize potentially malicious input.\n\n- **Implement input sanitization:** Ensure that all user-supplied input is properly sanitized before processing or output. Currently, no sanitization mechanisms are in place, which should be addressed as a priority.\n\n- **Enforce security headers and cookie attributes:**\n - **Content Security Policy (CSP):** Define and enforce a strict CSP to limit the execution of unauthorized scripts.\n - **HttpOnly flag:** Set the `HttpOnly` attribute on session cookies to prevent client-side script access.\n - **SameSite attribute:** Configure the `SameSite` cookie attribute to mitigate Cross-Site Request Forgery (CSRF) risks.\n - **Secure flag:** Ensure all cookies are transmitted only over HTTPS by enabling the `Secure` attribute.\n\n These measures collectively reduce the impact of XSS and help prevent escalation paths such as CSRF via XSS.\n\n# Ready Video POC:\nhttps://mega.nz/file/eNFXgAAA#IETbPcKwr5vVLqJIAdc3uy4qgcVTgyPb_2HhB4zcwAE",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "ci4-cms-erp/ci4ms"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.31.0.0"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 0.28.6.0"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-85m8-g393-jcxf"
45+
},
46+
{
47+
"type": "PACKAGE",
48+
"url": "https://github.com/ci4-cms-erp/ci4ms"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-79"
54+
],
55+
"severity": "CRITICAL",
56+
"github_reviewed": true,
57+
"github_reviewed_at": "2026-04-01T22:04:21Z",
58+
"nvd_published_at": null
59+
}
60+
}

‎advisories/github-reviewed/2026/04/GHSA-g4pp-fhgf-8653/GHSA-g4pp-fhgf-8653.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g4pp-fhgf-8653",
4+
"modified": "2026-04-01T22:04:54Z",
5+
"published": "2026-04-01T22:04:54Z",
6+
"aliases": [
7+
"CVE-2026-34564"
8+
],
9+
"summary": "CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS",
10+
"details": "## Summary \n### **Vulnerability: Stored DOM XSS via Pages Added to Menu (Persistent Payload Injection)**\n- Stored Cross-Site Scripting via Unsafe Rendering of Page Entries in Menu Management\n\n### Description\nThe application fails to properly sanitize user-controlled input when **adding Pages to navigation menus** through the Menu Management functionality. Page-related data selected via the Pages section is stored server-side and rendered without proper output encoding.\n\nThis stored payload is later rendered unsafely within administrative interfaces and public-facing navigation menus, leading to stored DOM-based cross-site scripting (XSS).\n\n### Affected Functionality\n- Menu Management – Pages section\n- Adding pages to navigation menus\n- Menu storage and rendering logic\n\n### Attack Scenario\n- An attacker creates or controls a page containing a malicious JavaScript payload.\n- The attacker adds the page to the menu using the **Pages** functionality in Menu Manager.\n- The application stores the menu entry without sanitization or encoding.\n- The payload persists and executes whenever the menu is rendered in administrative or public-facing interfaces.\n\n### Impact\n- Persistent Stored DOM XSS\n- Execution of arbitrary JavaScript in victims’ browsers\n- Privilege escalation when viewed by administrators or privileged users\n- Full administrator account takeover\n- Full account takeover across all roles via the navigation menu\n- Full compromise of the entire application due to global execution in the navigation menu\n\n**Endpoint:**\n- `/backend/menu/`\n\n## Steps To Reproduce (POC)\n1. Navigate to the **Menu Management** section of the application.\n2. Use the **Pages** functionality to add a page containing an XSS payload such as:\n`<img src=x onerror=alert(document.domain)>`\n3. Save the menu entry.\n4. View the menu in the administrative panel or any public-facing page.\n5. Observe the JavaScript payload executing automatically when the menu is rendered.\n\n## Remediation\n\n- **Avoid unsafe DOM manipulation methods:** Do not use `.html()`, `innerHTML`, or similar sink functions in client-side JavaScript or server-side templating (e.g., PHP). Even when user input flowing into these sinks is not immediately apparent, they can introduce Cross-Site Scripting (XSS) vulnerabilities that an attacker may exploit.\n\n- **Apply output encoding:** Implement HTML entity encoding on all user-controlled data before rendering it in the browser. This helps neutralize potentially malicious input.\n\n- **Implement input sanitization:** Ensure that all user-supplied input is properly sanitized before processing or output. Currently, no sanitization mechanisms are in place, which should be addressed as a priority.\n\n- **Enforce security headers and cookie attributes:**\n - **Content Security Policy (CSP):** Define and enforce a strict CSP to limit the execution of unauthorized scripts.\n - **HttpOnly flag:** Set the `HttpOnly` attribute on session cookies to prevent client-side script access.\n - **SameSite attribute:** Configure the `SameSite` cookie attribute to mitigate Cross-Site Request Forgery (CSRF) risks.\n - **Secure flag:** Ensure all cookies are transmitted only over HTTPS by enabling the `Secure` attribute.\n\n These measures collectively reduce the impact of XSS and help prevent escalation paths such as CSRF via XSS.\n# Ready Video POC:\nhttps://mega.nz/file/2c8lHSBQ#vwFDj0vhq7vLwMJjBjnAgbHWiIdFqUxAA913H_yQExQ",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "ci4-cms-erp/ci4ms"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.31.0.0"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 0.28.6.0"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-g4pp-fhgf-8653"
45+
},
46+
{
47+
"type": "PACKAGE",
48+
"url": "https://github.com/ci4-cms-erp/ci4ms"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-79"
54+
],
55+
"severity": "CRITICAL",
56+
"github_reviewed": true,
57+
"github_reviewed_at": "2026-04-01T22:04:54Z",
58+
"nvd_published_at": null
59+
}
60+
}

‎advisories/github-reviewed/2026/04/GHSA-r33w-c82v-x5v7/GHSA-r33w-c82v-x5v7.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r33w-c82v-x5v7",
4+
"modified": "2026-04-01T22:06:50Z",
5+
"published": "2026-04-01T22:06:50Z",
6+
"aliases": [
7+
"CVE-2026-34567"
8+
],
9+
"summary": "CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS",
10+
"details": "# Summary \n### **Vulnerability: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS**\n- Stored Cross-Site Scripting via Unsanitized Blog Post Content in Blog Management (Categories)\n\n### Description\nThe application fails to properly sanitize user-controlled input when creating or editing blog posts within the **Categories** section. An attacker can inject a malicious JavaScript payload into the **Categories** content, which is then stored server-side.\n\nThis stored payload is later rendered unsafely when the **Categories** are viewed via blog posts, without proper output encoding, leading to stored cross-site scripting (XSS).\n\n### Affected Functionality\n- Blog post **Categories** creation functionality\n- Blog post **Categories** editing functionality\n- Blog post **Categories** storage and retrieval logic\n\n### Attack Scenario\n- An attacker creates or edits a blog post **Category** to include a malicious XSS payload in the category description or name.\n- The application stores this content without sanitization or encoding.\n- The payload persists and executes whenever the category is viewed within the blog posts section, leading to the execution of arbitrary JavaScript in the victim’s browser.\n\n### Impact\n- Persistent Stored XSS\n- Execution of arbitrary JavaScript in victims’ browsers\n- Privilege escalation when viewed by administrators or privileged users within the **Categories** functionality\n- Full administrator account takeover through **Categories** access\n- Full account takeover across all roles via **Categories** pages\n- Full compromise of the entire application via XSS in **Categories**\n\n**Endpoints:**\n- `/backend/blogs/create` (Categories specific)\n- `/backend/blogs/` (Categories view)\n- `/blog/{id}` (Rendered blog post under Categories)\n\n## Steps To Reproduce (POC)\n1. Go to the **Categories** section of the blog management panel.\n2. Create a new category or edit an existing category.\n3. Insert an XSS payload into the category content, such as:\n`<img src=x onerror=alert(document.domain)>`\n4. Save or publish the Categories.\n5. View the category via the blog posts in the administrative panel or public blog page under the Categories section.\n6. Notice the XSS payload executing automatically when the Category is viewed in the Blog Posts.\n\n## Remediation\n\n- **Avoid unsafe DOM manipulation methods:** Do not use `.html()`, `innerHTML`, or similar sink functions in client-side JavaScript or server-side templating (e.g., PHP). Even when user input flowing into these sinks is not immediately apparent, they can introduce Cross-Site Scripting (XSS) vulnerabilities that an attacker may exploit.\n\n- **Apply output encoding:** Implement HTML entity encoding on all user-controlled data before rendering it in the browser. This helps neutralize potentially malicious input.\n\n- **Implement input sanitization:** Ensure that all user-supplied input is properly sanitized before processing or output. Currently, no sanitization mechanisms are in place, which should be addressed as a priority.\n\n- **Enforce security headers and cookie attributes:**\n - **Content Security Policy (CSP):** Define and enforce a strict CSP to limit the execution of unauthorized scripts.\n - **HttpOnly flag:** Set the `HttpOnly` attribute on session cookies to prevent client-side script access.\n - **SameSite attribute:** Configure the `SameSite` cookie attribute to mitigate Cross-Site Request Forgery (CSRF) risks.\n - **Secure flag:** Ensure all cookies are transmitted only over HTTPS by enabling the `Secure` attribute.\n\n These measures collectively reduce the impact of XSS and help prevent escalation paths such as CSRF via XSS.\n\n# Ready Video POC:\nhttps://mega.nz/file/SAdVxK7b#kFW_sFOim_d_1AnVcpwvzOEV4MHv33LLooL4Xa_Ymgg",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "ci4-cms-erp/ci4ms"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.31.0.0"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 0.28.6.0"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-r33w-c82v-x5v7"
45+
},
46+
{
47+
"type": "PACKAGE",
48+
"url": "https://github.com/ci4-cms-erp/ci4ms"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-79"
54+
],
55+
"severity": "CRITICAL",
56+
"github_reviewed": true,
57+
"github_reviewed_at": "2026-04-01T22:06:50Z",
58+
"nvd_published_at": null
59+
}
60+
}

0 commit comments

Comments
 (0)