CVE-2024-35110
📋 TL;DR
A reflected cross-site scripting (XSS) vulnerability in YzmCMS 7.1 allows attackers to steal session cookies from logged-in users. When authenticated users click malicious links containing crafted payloads, attackers can capture their authentication cookies. This affects all YzmCMS 7.1 installations with default configurations.
💻 Affected Systems
- YzmCMS
📦 What is this software?
Yzmcms by Yzmcms
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full administrative access to the CMS, and potentially compromise the entire web application and underlying server.
Likely Case
Attackers steal user session cookies to hijack accounts, perform unauthorized actions, and access sensitive user data within the CMS.
If Mitigated
With proper input validation and output encoding, the attack fails to execute JavaScript payloads, preventing cookie theft.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated users into clicking malicious links.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.2 or later
Vendor Advisory: https://github.com/yzmcms/yzmcms/issues/68
Restart Required: No
Instructions:
1. Backup your current installation. 2. Download YzmCMS 7.2 or later from the official repository. 3. Replace the vulnerable file yzmphp/core/class/application.class.php with the patched version. 4. Verify the fix by testing with XSS payloads.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side input validation to sanitize user input before processing.
Modify application.class.php to implement htmlspecialchars() or similar filtering on user inputs
Content Security Policy
allImplement CSP headers to restrict script execution from untrusted sources.
Add header: Content-Security-Policy: script-src 'self'
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads in URLs
- Educate users about phishing risks and implement session timeout policies
🔍 How to Verify
Check if Vulnerable:
Test by accessing a URL with XSS payload like: /path?param=<script>alert(1)</script> while authenticatedCheck Version:
Check YzmCMS version in admin panel or read version.txt fileVerify Fix Applied:
After patching, test with same XSS payload - script should not execute and should be properly encoded in output📡 Detection & Monitoring
Log Indicators:
- Unusual long URLs with script tags in access logs
- Multiple failed login attempts followed by successful login from new IP
Network Indicators:
- HTTP requests containing <script> tags in query parameters
- Outbound connections to suspicious domains after user visits crafted URLs
SIEM Query:
source="web_access.log" AND ("<script" OR "javascript:" OR "onerror=" OR "onload=")