Executive brief
u5CMS, a content management system, is vulnerable to a security flaw where attackers can inject malicious scripts into web pages viewed by other users. This occurs through a specific 'thanks' parameter used in various website forms. If an attacker successfully tricks a user into clicking a malicious link, they could potentially steal session information or perform unauthorized actions on behalf of that user.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in u5CMS versions up to and including 12.8.8. The flaw is located within the 'thanks' parameter used across multiple form components, which fails to properly sanitize user-supplied input before reflecting it back in the HTTP response. An unauthenticated remote attacker can exploit this by crafting a malicious URL containing JavaScript and social engineering a victim into clicking it. Successful exploitation allows the execution of arbitrary script code in the context of the victim's browser session, potentially leading to session hijacking or unauthorized data modification. The issue is resolved in version 12.8.9.
Affected products
- u5CMS u5CMS 0 through 12.8.8
Timeline
- 2026-07-02: disclosed
- 2026-07-02: advisory
- 2026-07-02: patched: Fixed in version 12.8.9