Executive brief
Sourcecodester Fantastic Blog CMS, a platform used for managing web content and blogs, contains a security vulnerability that allows attackers to inject malicious scripts. By submitting specially crafted text into the 'address' field when editing member profiles, an attacker can execute code in the browser of other users who view that profile. This could lead to unauthorized actions being performed on behalf of users, theft of session information, or defacement of the blog's administrative interface.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in Sourcecodester Fantastic Blog CMS 1.0. The vulnerability is located in the 'address' parameter of the pageEditMember.php component, which fails to properly sanitize user-supplied input before storing it in the database. When a user or administrator subsequently views the affected profile via ViewpageMember.php, the malicious script is executed in their browser context. An attacker can exploit this to perform session hijacking or unauthorized administrative actions. No official patch has been identified in the provided advisory.
Affected products
- Sourcecodester Fantastic Blog CMS 1.0
Timeline
- 2025-08-24: disclosed: Vulnerability discovered and exploit details documented.
- 2026-07-29: advisory: CVE published to the NVD.