Description

A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/member_deal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-10-12T09:16:42.847Z",
  "pubdate": "2026-10-12T09:16:42.847Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability has been identified in idcCMS version 1.70. The flaw resides within an unspecified function located in the 'admin/member_deal.php' file.\nThis vulnerability allows remote, unauthenticated or authenticated attackers to inject and execute arbitrary malicious JavaScript within the context of a victim's browser session.\nThe primary impact involves the potential for unauthorized access to sensitive user data, session hijacking, or the manipulation of the administrative interface.\nGiven that the exploit has been publicly disclosed, the risk of exploitation is significantly elevated. Organizations utilizing this specific version of idcCMS are exposed to malicious actors capable of executing scripts that originate from the application's own domain, effectively bypassing standard Same-Origin Policy (SOP) protections.\nThe vulnerability necessitates immediate attention to mitigate risks associated with unauthorized script execution and potential administrative compromise.",
  "technicalDetails": "The vulnerability in idcCMS 1.70 is categorized as a Reflected or Stored Cross-Site Scripting (XSS) flaw, stemming from the improper sanitization of user-supplied input handled by the 'admin/member_deal.php' script.\nThe root cause is the failure of the application to properly validate and encode inputs before rendering them back to the user within the administrative interface. When an attacker supplies malicious input—typically through HTTP GET or POST parameters directed at the 'admin/member_deal.php' file—the application reflects this data into the HTML response without appropriate context-aware output encoding.\nThe attack flow begins with the attacker crafting a malicious payload, such as a script tag containing arbitrary JavaScript (e.g., '<script>alert(document.cookie)</script>'). This payload is transmitted to the vulnerable file via a remote request.\nUpon processing the input, the server embeds the raw payload into the HTTP response. When the administrative user's browser parses this response, the browser treats the injected script as legitimate code originating from the trusted idcCMS domain. Consequently, the script executes within the security context of the session, granting the attacker access to session tokens, local storage, or the ability to perform actions on behalf of the administrator.\nBecause the vulnerability is located within 'admin/member_deal.php', it specifically targets the administrative functionality of the system, posing a high risk for full site compromise. The lack of input validation and output encoding enables the bypass of security filters, allowing the script to execute regardless of the victim's underlying operating system or browser type, provided the browser parses the malicious HTML structure.\nExploitation is feasible remotely and does not strictly require deep knowledge of the server-side infrastructure, as the primary objective is to manipulate the client-side representation of the data. Successful exploitation permits the attacker to hijack active sessions, exfiltrate administrative data, or perform unauthorized administrative actions, fundamentally undermining the integrity and confidentiality of the idcCMS installation."
}