| タイトル | YzmCMS V7.6 Cross Site Scripting |
|---|
| 説明 | During the security review of "YzmCMS V7.6", I discovered a reflected Cross-Site Scripting vulnerability in the `attachment/api/img_cropper` action (`/application/attachment/controller/api.class.php`). This vulnerability stems from insufficient user input validation of the 'cid' parameter, allowing attackers to inject malicious script tags into the response page. The crafted payload closes the enclosing inline `<script>` block via `</script>` and opens a new one, so the JavaScript executes as soon as the page is loaded by any logged-in user, without requiring interaction. Successful exploitation can lead to cookie theft, session hijacking, and performing privileged operations under the victim's identity. Immediate remedial measures are needed to ensure system security and protect data integrity.
|
|---|
| ソース | ⚠️ https://github.com/Witiers/CVEs/issues/5 |
|---|
| ユーザー | Witiers (UID 99561) |
|---|
| 送信 | 2026年08月28日 09:51 (2 月 ago) |
|---|
| モデレーション | 2026年10月10日 15:36 (1 month later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 220194 [yzmcms 6.1 Image Clipping クロスサイトスクリプティング] |
|---|
| ポイント | 0 |
|---|