7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35035

CVE-2026-35035: CI4MS Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.2.0, the application fails to properly sanitize user-controlled input within System Settings – Company Information. Several administrative configuration fields accept attacker-controlled input that is stored server-side and later rendered without proper output encoding. These values are persisted in the database and rendered unsafely on public-facing pages only, such as the main landing page. There is no execution in the administrative dashboard—the vulnerability only impacts the public frontend. This vulnerability is fixed in 0.31.2.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35035

CVE-2026-35035:

7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ci4-cms-erp/ci4ms	composer	<= 0.31.1.0	0.31.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue originating from the 'System Settings' page. The root cause is the insufficient sanitization of user-provided data before it is saved to the database. This stored malicious data is then rendered on public-facing pages, executing in the browsers of visitors.

The analysis of the patch commit revealed two key functions in modules/Settings/Controllers/Settings.php that were responsible for processing and storing the vulnerable data:

Modules\Settings\Controllers\Settings::compInfosPost: This function handles the 'Company Information' form. The patch shows that several fields, most notably the 'Google Maps iframe' (cMap), were not properly sanitized. The fix involves adding stricter validation rules and explicitly removing JavaScript event handlers from the iframe input. This function is a runtime indicator when an attacker is injecting the payload.
Modules\Settings\Controllers\Settings::socialMediaPost: This function handles the 'Social Media' links. The patch shows the addition of strip_tags to the social media name field (smName), indicating that it was previously possible to store HTML and script content in this field.

While the patch does not include the public-facing views where the XSS payload would execute, the identified functions are the entry point for the malicious data. Therefore, they are critical indicators of the vulnerability being present and are the functions that would appear in a runtime profile during the injection phase of an exploit.

Vulnerable functions

Modules\Settings\Controllers\Settings::compInfosPost

modules/Settings/Controllers/Settings.php

This function processes and stores company information from the settings page. The vulnerability lies in the insufficient sanitization of the 'Google Maps iframe link' field (`cMap`). Before the patch, it was possible to inject JavaScript event handlers (e.g., `onerror`) within the `<iframe>` tag. The patch mitigates this by using `preg_replace` to strip `on*` event attributes from the input before saving it to the database, thus preventing the stored XSS payload.

Modules\Settings\Controllers\Settings::socialMediaPost

modules/Settings/Controllers/Settings.php

This function handles the saving of social media links. The 'smName' (social media name) field was previously stored without proper sanitization, allowing an attacker to inject HTML and JavaScript. The patch adds `strip_tags` to remove any HTML from the 'smName' input before it is stored, preventing the stored XSS vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.