Description
Kuicms Php EE 2.0 contains a persistent cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted content through the bbs reply endpoint. Attackers can send POST requests to /web/?c=bbs&a=reply with HTML and JavaScript payloads in the content parameter to execute arbitrary scripts in users' browsers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kuicms | Kuicms Php EE | 2.0 | — |
References
- ExploitDB-48526 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: Kuicms Php EE 2.0 Persistent Cross-Site Scripting via bbs reply third-party-advisory