CVE-2010-0695 in BASIC-CMS
Summary
by MITRE
Cross-site scripting (XSS) vulnerability in pages/index.php in BASIC-CMS allows remote attackers to inject arbitrary web script or HTML via the nav_id parameter.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/01/2026
The vulnerability identified as CVE-2010-0695 represents a classic cross-site scripting flaw within the BASIC-CMS content management system, specifically affecting the pages/index.php file. This issue arises from inadequate input validation and sanitization mechanisms that fail to properly handle user-supplied data passed through the nav_id parameter. The vulnerability classifies under CWE-79 which defines improper neutralization of input during web page generation, making it a prime example of how insufficient data validation can lead to severe security implications in web applications.
The technical exploitation of this vulnerability occurs when an attacker crafts malicious input containing script code within the nav_id parameter and submits it to the vulnerable pages/index.php endpoint. When the application processes this input without proper sanitization, the injected script executes within the context of other users' browsers who subsequently access the affected page. This creates a persistent threat vector that can be leveraged for session hijacking, credential theft, or redirection to malicious sites. The vulnerability operates at the application layer and requires no privileged access, making it particularly dangerous as it can be exploited by any remote attacker with knowledge of the target system's URL structure.
The operational impact of CVE-2010-0695 extends beyond simple script injection, as it fundamentally compromises the integrity of user sessions and can enable more sophisticated attacks within the compromised environment. Attackers can leverage this vulnerability to steal cookies, modify page content, redirect users to phishing sites, or even execute malicious code on behalf of authenticated users. This vulnerability directly violates the principle of least privilege and can lead to complete system compromise if combined with other vulnerabilities or used as a foothold for further attacks. The attack surface is particularly concerning as it affects the core navigation functionality of the CMS, potentially allowing attackers to manipulate site structure and content delivery.
Mitigation strategies for this vulnerability should focus on implementing robust input validation and output encoding mechanisms throughout the application. The primary defense involves sanitizing all user-supplied input, particularly parameters like nav_id, through proper escaping and encoding techniques before processing or rendering. Organizations should implement Content Security Policy headers to limit script execution contexts and deploy web application firewalls to detect and block malicious payloads. Additionally, regular security assessments and code reviews should be conducted to identify similar vulnerabilities in other application components, as this type of issue commonly occurs in legacy systems. The remediation process should include updating the BASIC-CMS to versions that address this specific vulnerability while implementing comprehensive input validation across all user-facing parameters to prevent similar issues from emerging in the future. This vulnerability demonstrates the critical importance of adhering to secure coding practices and following established security frameworks such as those defined in the OWASP Top Ten and NIST guidelines for preventing XSS attacks through proper input handling and output encoding mechanisms.