YiFang CMS 2.0.5 allows attackers to inject malicious code

Summary

A vulnerability in YiFang CMS 2.0.5 allows attackers to inject malicious code into the system by manipulating certain input fields. This could potentially allow them to take control of the website or steal sensitive information. We recommend that you update to the latest version of YiFang CMS to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
yifangcms	yifang	2.0.5	–

Original title

A flaw has been found in YiFang CMS 2.0.5. This affects the function update of the file app/db/admin/D_singlePageGroup.php. Executing a manipulation of the argument Name can lead to cross site scri...

Original description

A flaw has been found in YiFang CMS 2.0.5. This affects the function update of the file app/db/admin/D_singlePageGroup.php. Executing a manipulation of the argument Name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvd CVSS2.0 4.0

nvd CVSS3.1 3.5

nvd CVSS4.0 5.1

Vulnerability type

CWE-79 Cross-site Scripting (XSS)

CWE-94 Code Injection