| Título | YzmCMS V7.6 Cross Site Scripting |
|---|
| Descripción | During the security review of "YzmCMS V7.6", I discovered a reflected Cross-Site Scripting vulnerability in the `attachment/api/img_cropper` action (`/application/attachment/controller/api.class.php`). This vulnerability stems from insufficient user input validation of the 'cid' parameter, allowing attackers to inject malicious script tags into the response page. The crafted payload closes the enclosing inline `<script>` block via `</script>` and opens a new one, so the JavaScript executes as soon as the page is loaded by any logged-in user, without requiring interaction. Successful exploitation can lead to cookie theft, session hijacking, and performing privileged operations under the victim's identity. Immediate remedial measures are needed to ensure system security and protect data integrity.
|
|---|
| Fuente | ⚠️ https://github.com/Witiers/CVEs/issues/5 |
|---|
| Usuario | Witiers (UID 99561) |
|---|
| Sumisión | 2026-08-28 09:51 (hace 2 meses) |
|---|
| Moderación | 2026-10-10 15:36 (1 month later) |
|---|
| Estado | Duplicado |
|---|
| Entrada de VulDB | 220194 [yzmcms 6.1 Image Clipping secuencias de comandos en sitios cruzados] |
|---|
| Puntos | 0 |
|---|