CI4MS Backup Module Stored DOM XSS Vulnerability Leading to Full Account Takeover and Privilege Escalation

A stored DOM-based cross-site scripting vulnerability has been identified in the CI4MS content management system, specifically in version 0.31.4.0. This vulnerability allows an attacker to achieve full account takeover and privilege escalation by manipulating the backup module's filename field. The exploitation involves using a SQL file to alter the filename field, embedding a hidden XSS payload. The issue has been addressed in version 0.31.5.0.

Impact

Exploitation of this vulnerability allows for full account takeover and privilege escalation for all user roles.

Remediation

Users are advised to update to version 0.31.5.0, where this vulnerability has been patched.