Vulnerability feed

Executive summary

A stored cross-site scripting flaw has been reported in GouguCMS up to version 4.08.18, affecting its user level management feature. An administrator account can save malicious script as a user level name, which then runs in the browser of any administrator who views the list. The advisory does not state a severity rating or a vendor fix, so the recommended response is not stated.

Technical summary

This is a stored cross-site scripting (XSS) vulnerability in the user level function of GouguCMS v4.08.18, in app/admin/controller/Level.php and related files. An authenticated administrator can submit HTML or JavaScript in the title parameter, which is stored in cms_user_level.title without output encoding and rendered as HTML in the admin user-level list. The advisory provides a proof-of-concept POST request to /admin/level/add that sets the title to a script tag, and notes the same value also appears in the user list via /admin/user/index. The advisory does not state a fixed version, a workaround, a CVSS score, or whether exploitation has been observed in the wild. Detection guidance beyond the reproduction steps is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/yuhuixiaowu/cve/blob/main/go…ucms_v4.08.18_XSS.md

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

High

User interaction

Passive

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

GouguCMSGouguCMS