| Название | YzmCMS V7.6 Cross Site Scripting |
|---|
| Описание | During the security review of "YzmCMS V7.6", I discovered a reflected Cross-Site Scripting vulnerability in the `attachment/api/img_cropper` action (`/application/attachment/controller/api.class.php`). This vulnerability stems from insufficient user input validation of the 'cid' parameter, allowing attackers to inject malicious script tags into the response page. The crafted payload closes the enclosing inline `<script>` block via `</script>` and opens a new one, so the JavaScript executes as soon as the page is loaded by any logged-in user, without requiring interaction. Successful exploitation can lead to cookie theft, session hijacking, and performing privileged operations under the victim's identity. Immediate remedial measures are needed to ensure system security and protect data integrity.
|
|---|
| Источник | ⚠️ https://github.com/Witiers/CVEs/issues/5 |
|---|
| Пользователь | Witiers (UID 99561) |
|---|
| Представление | 28.08.2026 09:51 (2 месяцы назад) |
|---|
| Модерация | 10.10.2026 15:36 (1 month later) |
|---|
| Статус | Дубликат |
|---|
| Запись VulDB | 220194 [yzmcms 6.1 Image Clipping межсайтовый скриптинг] |
|---|
| Баллы | 0 |
|---|