a-blog cms Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in a-blog cms versions prior to 3.1.43 and 3.0.47. This vulnerability exists in a specific field on the entry editing screen, and exploitation requires contributor or higher-level privileges. When exploited, it allows for the execution of arbitrary scripts in the web browser of the logged-in user.

Impact

Exploitation of this vulnerability allows for the execution of arbitrary scripts in the web browser of the user logged into a-blog cms.

Remediation

Users are advised to update a-blog cms to the latest version. For versions 3.1.x and 3.0.x, specific fixed versions are available. Consult the a-blog cms developer site for details on the latest versions. Additionally, a workaround is available by setting 'HOOK_ENABLE' to '1' in 'config.server.php' and modifying 'extension/acms/Hook.php' or 'php/ACMS/User/Hook.php'.