Dayrui XunRuiCMS Cross-Site Scripting Vulnerability in Domain Name Binding Page

A cross-site scripting (XSS) vulnerability has been identified in Dayrui XunRuiCMS versions through 4.7.1. The issue resides in the Domain Name Binding Page, specifically within the file '/admin79f2ec220c7e.php?c=api&m=demo&name=mobile'. This vulnerability can be exploited remotely and is associated with a high level of complexity.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, first navigate to the Domain Name Binding settings and update the project domain name. After that, go to the Mobile Domain Name Change module and preview the website. This will trigger a URL redirection that can be exploited for XSS.