CyberRota Analysis
AI-GeneratedThe Pages backend module in CI4MS, prior to version 0.31.9.0, is vulnerable due to the improper handling of user input, allowing raw, un-purified POST values to be stored in the database. This results in a stored cross-site scripting (XSS) vulnerability that can be exploited by any public visitor, including administrators, potentially affecting the entire site if the compromised content is displayed on the homepage. Organizations using affected versions should prioritize upgrading to version 0.31.9.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module registers the `html_purify` validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages (`Home::index()` → `app/Views/templates/default/pages.php`) emits `$pageInfo->content` without `esc()`, yielding stored XSS that fires for every public visitor of the affected page — including administrators. Because pages may be promoted to the site home page, the payload can be served at `/` and reach every visitor of the site. Version 0.31.9.0 patches the issue.