itsourcecode Society Management System activity.php クロスサイトスクリプティング

The XSS vulnerability in isourcecode Society Management System allows an attacker to inject arbitrary JavaScript code into the application. This code will then be executed in the context of the user's browser when they access the affected page. An attacker could leverage this to steal session cookies, redirect users to malicious websites, or deface the application. The remote nature of the vulnerability means it can be exploited from anywhere with network access to the Society Management System. Given the availability of a public proof-of-concept, the risk of exploitation is considered high.

Organizations using isourcecode Society Management System version 1.0, particularly those with publicly accessible administration interfaces, are at risk. Shared hosting environments where multiple users share the same instance of the software are especially vulnerable, as an attacker could potentially compromise other users' accounts.

• generic web:

curl -I <affected_url>/admin/activity.php?Title=<xss_payload>

• generic web:

grep -i "<xss_payload>" /var/log/apache2/access.log

1. 2026-01-19Disclosure

   disclosure

1. 予約済み2026-01-18
2. 公開日2026-01-19
3. 更新日2026-02-23
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-1135 is to upgrade to a patched version of isourcecode Society Management System. As no fixed version is currently available, implement temporary workarounds to reduce the risk. These include implementing strict input validation on the Title parameter in /admin/activity.php, sanitizing user-supplied data, and deploying a Web Application Firewall (WAF) with rules to block XSS attacks. Consider implementing Content Security Policy (CSP) to restrict the sources from which scripts can be executed.