CyberRota Analysis
AI-GeneratedThe CI4MS content management system prior to version 0.31.9.0 is vulnerable to stored cross-site scripting (XSS) due to improper sanitization of blog post content, allowing attackers to inject malicious scripts that execute in the browsers of all visitors, including superadmins. This vulnerability arises from a flaw in the custom `html_purify` validation rule, which fails to properly sanitize input before it is stored and displayed. Organizations using affected versions should prioritize updating to version 0.31.9.0 to mitigate the risk of XSS attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom `html_purify` validation rule used to sanitize blog post bodies relies on by-reference mutation (`?string &$str`), but CodeIgniter 4's validator passes a local copy of the value, so the sanitized text is silently discarded. The Blog controller writes `$lanData['content']` directly into `blog_langs.content`, and the public template echoes it without escaping — yielding stored XSS executable in any visitor's browser, including the superadmin when previewing or editing posts. Version 0.31.9.0 patches the issue.