CI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

An attacker can leverage this XSS vulnerability to execute arbitrary JavaScript code in the context of a user's browser session. This could lead to session hijacking, credential theft, or defacement of the application. The stored nature of the vulnerability means that the malicious script persists on the server, potentially affecting multiple users who view the compromised company information page. Successful exploitation could also allow an attacker to redirect users to phishing sites or install malware, expanding the potential impact beyond the immediate application. The immediate same-page execution makes detection and prevention more challenging as the payload is executed immediately upon page load.

Organizations using ci4-cms-erp/ci4ms in production environments, particularly those with administrative users who regularly manage company information settings, are at risk. Shared hosting environments where multiple users share the same instance of the application are also particularly vulnerable, as a compromised account could affect all users on the server.

• php: Examine application logs for unusual activity related to the System Settings – Company Information section. Look for POST requests containing suspicious characters or patterns.

grep -i '<script' /var/log/apache2/access.log

• generic web: Use curl to test the company information endpoint with a simple XSS payload and observe the response.

curl -X POST -d "company_name=<script>alert('XSS')</script>" http://your-ci4ms-instance/system_settings/company_info

• generic web: Check response headers for Content-Security-Policy (CSP) directives. A strong CSP can mitigate XSS attacks.

curl -I http://your-ci4ms-instance/system_settings/company_info

1. 2026-04-01Disclosure

   disclosure

1. आरक्षित2026-03-30
2. प्रकाशित2026-04-01
3. संशोधित2026-04-06
4. EPSS अद्यतन2026-04-09

The primary mitigation for CVE-2026-34562 is to upgrade to version 0.31.0.0 or later of ci4-cms-erp/ci4ms. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious input in the company information fields. Specifically, look for patterns associated with JavaScript injection, such as <script> tags, event handlers (e.g., onload, onclick), and common XSS payloads. Additionally, review and tighten input validation and output encoding practices within the application to prevent future XSS vulnerabilities. After upgrading, confirm the fix by attempting to inject a simple XSS payload into the company information settings and verifying that it is properly sanitized.

अंतिम अपडेट

0.31.9हाल ही में