CI4MS: Compromission complète de la plateforme et prise de contrôle total des comptes pour tous les rôles et élévation de privilèges via les paramètres système, Informations de l'entreprise, par le biais d'un XSS DOM stocké

The impact of CVE-2026-35035 is severe due to the potential for full account takeover and privilege escalation. An attacker can inject arbitrary JavaScript code into the System Settings Company Information section, which is accessible via public-facing landing pages. This allows them to steal user credentials, modify data, perform actions on behalf of the compromised user, and potentially gain control of the entire application. The blind nature of the XSS makes it harder to detect, as the payload execution might not be immediately visible to the user, increasing the risk of persistent compromise. This vulnerability could lead to significant data breaches, financial losses, and reputational damage.

Organizations using ci4-cms-erp/ci4ms in production environments, particularly those with public-facing landing pages and inadequate input validation, are at significant risk. Shared hosting environments where multiple users share the same instance of ci4-cms-erp/ci4ms are also particularly vulnerable, as a compromise of one user account could potentially lead to the compromise of the entire system.

• php: Examine application logs for suspicious JavaScript code being stored in the System Settings Company Information section. Use grep to search for <script> tags or other XSS payload indicators within the database entries associated with this section.

grep -r '<script' /path/to/database/files

• generic web: Monitor access logs for requests containing unusual or obfuscated JavaScript code in the Company Information field. Use curl to test the affected endpoint with a simple XSS payload and observe the response.

curl -X POST -d "Company Information=<script>alert('XSS')</script>" https://your-ci4ms-instance/system-settings/company-information

1. 2026-04-06Disclosure

   disclosure

1. Réservé2026-03-31
2. Publiée2026-04-06
3. Modifiée2026-04-10
4. EPSS mis à jour2026-04-14

The primary mitigation for CVE-2026-35035 is to upgrade to version 0.31.2.0 or later, which contains the fix. If upgrading immediately is not possible, consider implementing temporary workarounds. Input validation and sanitization on the System Settings Company Information section should be implemented to prevent the injection of malicious scripts. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Regularly review and update security policies and procedures to ensure they address XSS vulnerabilities.

Dernière mise à jour

0.31.9récemment