GHSA-5ghq-42rg-769x
CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | ci4-cms-erp/ci4ms | < 0.31.2.0 | 0.31.2.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
An attacker can acheive Full Account Takeover & Privilege Escalation via Stored DOM Blind XSS on public-facing landing pages through the System Settings Company Information section which allows the injection of XSS payloads
References
External links from the advisory. They lead to third-party sites.