Phpcms Privilege Escalation Vulnerability via Cross-Site Scripting in Member Center

A stored cross-site scripting vulnerability has been identified in Phpcms version 9.6.3. This issue allows remote attackers to inject malicious scripts that are executed in the context of the user viewing the member center interface. The vulnerability arises from the menu management feature in the admin panel, where input is not properly sanitized before being saved and later displayed, potentially leading to privilege escalation.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, log into the Phpcms admin panel and navigate to the member center menu management interface. Add a new menu item, ensuring to include a script payload in the name or language fields. Once the menu item is saved, the injected script will execute when any user accesses the member center.