Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-36607

CVE-2020-36607: FeehiCMS Cross Site Scripting vulnerability

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-36607
GHSA ID
GHSA-6jj8-mqx2-7fg5
EPSS Score
0.36679%
CWE
CWE-79
Published
12/15/2022
Updated
1/28/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
feehi/feehicmscomposer<= 2.0.8

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The XSS vulnerability stems from the actionLanguage function in SiteController.php not sanitizing the 'lang' input. This allows attackers to supply a malicious payload via the lang parameter, which is then reflected in the HTML lang attribute without proper escaping in the layout file. The combination of unvalidated input and lack of output encoding enables the execution of arbitrary JavaScript code.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*ross Sit* S*riptin* (XSS) vuln*r**ility in ****i*MS *.*.* *llows r*mot* *tt**k*rs to run *r*itr*ry *o** vi* t** l*n* *ttri*ut* o* *n *tml t**.

Reasoning

T** XSS vuln*r**ility st*ms *rom t** `**tionL*n*u***` *un*tion in `Sit**ontroll*r.p*p` not s*nitizin* t** 'l*n*' input. T*is *llows *tt**k*rs to supply * m*li*ious p*ylo** vi* t** l*n* p*r*m*t*r, w*i** is t**n r**l**t** in t** *TML l*n* *ttri*ut* wit