CVE-2017-20061: Cross site scripting in Elefant CMS

The vulnerability manifests in the /admin/extended endpoint's handling of the 'name' parameter. The PoC shows a direct injection via URL parameters (%3Cimg... payload), indicating the input is reflected unsanitized. In Elefant CMS's MVC structure, this would correspond to a handler method (like Extended::index) responsible for processing the request. The lack of output encoding for the 'name' parameter before rendering it in the admin interface is the root cause. While the exact function name isn't explicitly disclosed, the endpoint and parameter correlation strongly implicate the request handler for this route.