flusity CMS Dashboard customblock.php loadCustomBlocCreateForm cross site scripting

Successful exploitation of CVE-2023-5793 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to a variety of malicious actions, including stealing user credentials, redirecting users to phishing sites, or modifying the content of the website. The vulnerability is remotely exploitable, meaning an attacker does not need to be authenticated to exploit it. Given the nature of XSS vulnerabilities, the potential impact can range from minor defacement to complete compromise of user accounts and data. The lack of versioning makes it difficult to determine the precise scope of affected installations, increasing the overall risk.

Organizations and individuals using flusity CMS are at risk. The lack of versioning means all installations are potentially vulnerable until the patch is applied. Shared hosting environments using flusity CMS are particularly vulnerable as they may lack the ability to easily apply patches.

• php / web:

 grep -r 'customblock_place' /var/www/flusity-cms/

• generic web:

 curl -I http://your-flusity-cms-site.com/core/tools/customblock.php?customblock_place=<script>alert('XSS')</script>

1. 2023-10-26Disclosure

   disclosure

1. आरक्षित2023-10-26
2. प्रकाशित2023-10-26
3. संशोधित2025-06-12
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2023-5793 is to apply the provided patch: 81252bc764e1de2422e79e36194bba1289e7a0a5. Since flusity CMS lacks versioning, applying this patch is the only known remediation. Consider implementing a Web Application Firewall (WAF) with XSS filtering rules as an additional layer of defense. Regularly review and sanitize user input to prevent future XSS vulnerabilities. After applying the patch, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert('XSS')</script>) through the custom block creation form and confirming that the script is not executed.