| 제목 | YzmCMS V7.6 Cross Site Scripting |
|---|
| 설명 | During the security review of "YzmCMS V7.6", I discovered a reflected Cross-Site Scripting vulnerability in the `attachment/api/img_cropper` action (`/application/attachment/controller/api.class.php`). This vulnerability stems from insufficient user input validation of the 'cid' parameter, allowing attackers to inject malicious script tags into the response page. The crafted payload closes the enclosing inline `<script>` block via `</script>` and opens a new one, so the JavaScript executes as soon as the page is loaded by any logged-in user, without requiring interaction. Successful exploitation can lead to cookie theft, session hijacking, and performing privileged operations under the victim's identity. Immediate remedial measures are needed to ensure system security and protect data integrity.
|
|---|
| 원천 | ⚠️ https://github.com/Witiers/CVEs/issues/5 |
|---|
| 사용자 | Witiers (UID 99561) |
|---|
| 제출 | 2026. 08. 28. AM 09:51 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 10. 10. PM 03:36 (1 month later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 220194 [yzmcms 6.1 Image Clipping 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 0 |
|---|