9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34557

CVE-2026-34557: CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within group and role management functionality. Multiple input fields (three distinct group-related fields) can be injected with malicious JavaScript payloads, which are then stored server-side. These stored payloads are later rendered unsafely within privileged administrative views without proper output encoding, leading to stored cross-site scripting (XSS) within the role and permission management context. This issue has been patched in version 0.31.0.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34557

CVE-2026-34557:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ci4-cms-erp/ci4ms	composer	<= 0.28.6.0	0.31.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue within the Group and Role Management functionality of the ci4ms application. The analysis began by identifying the vulnerable and patched versions from the advisory, which are <= 0.28.6.0 and 0.31.0.0 respectively. By comparing the git tags for these versions, I was able to isolate the commits that contain the security patch. The commit 296b2adee151b7a4eaeea7a2916bd4120e8d5bb3 stood out with a message indicating "security hardening" and "XSS/injection protection".

A detailed review of this commit revealed that multiple controller functions were modified to add input validation and output escaping. Specifically, in modules/Users/Controllers/PermgroupController.php, the group_create and group_update functions were identified as the source of the vulnerability. Before the patch, these functions directly saved user input from the group creation and editing forms to the database without any sanitization. The fields groupName, description, and seflink were all susceptible to XSS injection.

The patch addresses this by implementing two main changes:

Input Validation: It adds regex_match rules to the validation process to prevent malicious characters from being submitted.
Output Escaping: It uses the esc() helper function, which is CodeIgniter's built-in XSS filtering, before saving the data to the database and when rendering it in the views.

This confirms that the group_create and group_update functions were the vulnerable entry points that allowed for the stored XSS attack. An attacker could inject a malicious script into one of the group-related fields, and this script would be executed in the browser of any administrator viewing the group management page, leading to potential account takeover.

Vulnerable functions

PermgroupController::group_create

modules/Users/Controllers/PermgroupController.php

The `group_create` function is vulnerable to stored XSS. It directly uses user-provided input from the `groupName`, `description`, and `seflink` fields to create a new permission group without proper sanitization or escaping. An attacker can inject malicious JavaScript payloads into these fields, which are then stored in the database and executed in the browser of an administrator viewing the group management pages.

PermgroupController::group_update

modules/Users/Controllers/PermgroupController.php

The `group_update` function is vulnerable to stored XSS. It takes user input from the `groupName`, `description`, and `seflink` fields and updates the permission group information in the database without proper sanitization. This allows an attacker to inject malicious JavaScript payloads, which are then executed in the browser of an administrator viewing the group management pages.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.