CVE-2018-12094

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in Dimofinf CMS version 3.0.0. The flaw resides in the id parameter of the news.php script, which is accessed via a GET request. The application does not properly sanitize or validate user input before reflecting it in the response, enabling arbitrary HTML and script injection. [1]

Exploitation

An attacker can exploit this vulnerability remotely without authentication by crafting a malicious URL that contains the injected payload in the id parameter. For example, visiting a URL like http://target/news.php?id=604"</|><plaintext/onmouseover=prompt(/XSS/)> will cause the browser to execute the attacker's script when the page loads. No user interaction beyond clicking the link is required. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session within the affected CMS. This can lead to session hijacking, defacement, or theft of sensitive information displayed on the page. The attack is reflected (non-persistent), so the malicious payload is not stored on the server. [1]

Mitigation

The vendor has not released a patched version as of the publication date (2018-06-11). The reference recommends implementing proper output encoding and input validation for all user-supplied data, particularly the id parameter. Users should consider applying a WAF rule to block XSS payloads or upgrading to a later version of the CMS if available. [1]