Description

idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-21T21:17:15.893Z",
  "pubdate": "2026-09-21T21:17:15.893Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the idccms V1.70 administration module. The vulnerability is located in the /admin/makeDiy_deal.php file.\nThis flaw permits an authenticated attacker to inject and execute arbitrary JavaScript code within the context of an administrator's browser session. By successfully injecting malicious scripts, an attacker can bypass security controls to perform unauthorized actions on behalf of the administrator.\nThe primary risk implications include the potential for session hijacking, unauthorized data access, unauthorized administrative modifications, and the redirection of users to malicious external domains. As this vulnerability affects the administrative interface, it poses a critical threat to the overall integrity and security of the idccms deployment.\nSuccessful exploitation requires the attacker to have administrative access or to deceive an administrator into interacting with a crafted malicious request. The vulnerability is triggered through improper sanitization of user-supplied input before rendering it in the application's output.",
  "technicalDetails": "The vulnerability resides in the /admin/makeDiy_deal.php component of idccms V1.70. The root cause is the application's failure to adequately sanitize and encode user-supplied input parameters processed during the 'makeDiy' operation before rendering them within the HTML response sent to the administrator's browser.\nThe attack flow begins when an attacker crafts a malicious request containing a payload designed to break out of the intended HTML attribute or element context. Because the application logic in /admin/makeDiy_deal.php does not implement robust output encoding—such as converting special characters into their corresponding HTML entities (e.g., converting '<' to '&lt;' and '>' to '&gt;')—the injected payload is rendered directly as executable code.\nWhen the administrative user navigates to the compromised page, the victim's browser interprets the malicious script as legitimate application code. This results in the execution of the payload within the security origin of the administrative panel. The attack does not require direct access to the underlying server file system, as the exploit is reflected through the web-based administrative interface.\nThe impact of this XSS vulnerability is significant. Once executed, the malicious script can access sensitive information stored in the browser, such as Session IDs, cookies, and local storage tokens. Furthermore, the payload can be utilized to perform cross-site request forgery (CSRF) by initiating unauthorized background requests to change administrative passwords, create new users, or modify system configurations. Because the script runs with the privileges of the active administrative session, it effectively grants the attacker the same functional capabilities as the compromised account.\nThe vulnerability specifically affects the handling of input parameters passed to /admin/makeDiy_deal.php. Since idccms V1.70 lacks sufficient input validation and context-aware output filtering for this endpoint, it remains susceptible to various forms of reflected XSS attacks. The exposure is limited to the administrative interface, requiring an attacker to be authenticated or to successfully leverage an administrative session, significantly lowering the barrier for full system compromise."
}