## Summary
CI4MS (CodeIgniter 4-based CMS skeleton) versions prior to 0.31.0.0 improperly sanitize user-controlled blog post content on create/edit, enabling stored cross-site scripting (XSS). The injected JavaScript payload is stored server-side and later rendered unsafely in multiple views.
## Technical Details
- Root issue: insufficient input sanitization when creating or editing blog posts, followed by unsafe output rendering without proper output encoding.
- Vulnerability class: CWE-79 (Improper Neutralization of Input During Web Page Generation).
- Attack vector: AV:N (network-based), with low complexity (AC:L) and low/no user interaction (UI:N) as reflected in the provided CVSS vector.
- Affected data flow (as described):
- Attacker injects malicious JavaScript into blog post content.
- Payload is stored server-side.
- Payload is later rendered in multiple application views without proper output encoding.
## Affected
- ci4-cms-erp/ci4ms versions < 0.31.0.0
- ci4ms < 0.31.0.0
## Impact
- Stored XSS can execute attacker-controlled JavaScript in the context of affected users’ browsers.
- CVSS indicates high severity (9.1) with confidentiality impact (C:H) and integrity impact (I:L), availability impact (A:L), and scope change (S:C).
## Mitigation
1. Upgrade ci4ms to 0.31.0.0 or later (patch is stated in the advisory/NVD description).
2. Validate that the deployment is actually running the fixed release 0.31.0.0 (verify application version after upgrade).
3. Review blog post rendering templates/views to ensure output encoding is applied consistently to stored content.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
CWE-79