Executive brief
CicadasCMS, a content management system, contains a security flaw in its search functionality. An attacker can trick a logged-in administrator into clicking a malicious link, which allows the attacker to execute unauthorized commands in the administrator's browser. In practice, this can be used to silently create new administrator accounts, leading to a full takeover of the website and its data.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the 's' parameter of the /search interface in CicadasCMS. The application fails to sanitize input or validate data types for this parameter, reflecting malicious scripts back to the user's browser. This vulnerability can be chained with a lack of Anti-CSRF tokens in the /system/user/update endpoint. By inducing an authenticated administrator to visit a crafted URL, an attacker can bypass the Same-Origin Policy (SOP) and perform sensitive actions, such as creating a new administrator account. The issue was identified in version 1.0 (commit 2431154) and remains unpatched as of the advisory date.
Affected products
- westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab
Timeline
- 2026-05-04: disclosed: Issue reported to the project maintainer via Gitee
- 2026-05-30: advisory: Vulnerability published to NVD/VulDB