Thecosy IceCMS User Comment planet cross site scripting

Successful exploitation of CVE-2023-6466 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser. This can be leveraged to steal session cookies, redirect users to malicious websites, or modify the content of the website. The impact is particularly severe if the application handles sensitive user data or is used in a critical business process. Given the nature of XSS vulnerabilities, the attacker's actions are limited only by the permissions of the user whose session is hijacked.

Websites using IceCMS version 2.0.1 are at risk. This includes organizations that rely on IceCMS for content management and user interaction. Shared hosting environments where IceCMS is installed are particularly vulnerable, as they may be difficult to update quickly.

• php / web:

curl -I 'http://your-icecms-site.com/planet?comment=<script>alert(1)</script>' | grep -i 'content-type'

• generic web:

curl -s 'http://your-icecms-site.com/planet' | grep -i '<script>' 

1. 2023-12-02Disclosure

   disclosure

2. 2023-12-02Patch

   patch

1. 已保留2023-12-01
2. 发布日期2023-12-02
3. 修改日期2024-10-11
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2023-6466 is to upgrade IceCMS to version 2.0.2 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing input validation and output encoding on user-supplied data within the User Comment Handler. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Regularly review and update security rules to ensure they are effective against emerging threats.