CI4MS Stored Cross-Site Scripting Vulnerability via HTML Purification Bypass

A stored cross-site scripting vulnerability has been identified in CI4MS, a CodeIgniter 4-based content management system, in versions prior to 0.31.9.0. The issue arises from a custom 'html_purify' validation rule intended to sanitize blog post content. This rule relies on by-reference mutation, but CodeIgniter's validation system only passes a local copy of the data, causing the sanitized output to be discarded. As a result, raw HTML, including JavaScript, is stored in the database and executed in the browsers of all visitors, including superadmins, when posts are previewed or edited.

Impact

Exploitation of this vulnerability leads to stored cross-site scripting, where injected scripts are executed in the context of the user viewing the blog post. This includes superadmin users when they preview or edit posts, potentially allowing for session hijacking and unauthorized actions on behalf of the admin.

Reproduction

To reproduce this vulnerability, log into the backend with an account that has 'blogs.create' or 'blogs.update' permissions. Submit a blog post with a script payload in the content field. The 'html_purify' validation will incorrectly report success, and the raw HTML will be stored in the database. When the post is viewed publicly or previewed by a superadmin, the script will execute, demonstrating the cross-site scripting vulnerability.

Remediation

Users can upgrade to CI4MS version 0.31.9.0, which addresses this vulnerability by correcting the 'html_purify' validation rule to ensure proper sanitization before content is saved to the database.