Executive brief
Kuicms Php EE, a content management system, contains a security flaw in its forum reply system. An unauthenticated attacker can inject malicious scripts into the website by posting a specially crafted message. When other users or administrators view the affected page, these scripts execute in their browsers, potentially leading to unauthorized actions or the theft of sensitive session information.
Technical details
A persistent cross-site scripting (XSS) vulnerability exists in Kuicms Php EE 2.0 due to improper neutralization of input in the BBS reply component. An unauthenticated attacker can send a POST request to the `/web/?c=bbs&a=reply` endpoint with a malicious HTML or JavaScript payload in the `content` parameter. Because the application fails to properly sanitize this input before storing it and displaying it to other users, the script executes in the context of any user who views the affected forum thread. This can be used to hijack user sessions, perform actions on behalf of administrators, or deface the site. Public exploit code is available via Exploit-DB.
Affected products
- Kuicms Kuicms Php EE 2.0
Timeline
- 2020-05-27: disclosed: Exploit published on Exploit-DB
- 2026-05-13: advisory: NVD/VulnCheck advisory published