CVE-2018-20682

Vulnerability

Fork CMS versions up to and including 5.0.6 contain a stored cross-site scripting vulnerability in the private /en/settings endpoint. The facebook_admin_ids POST parameter (labeled "Admin ids" in the Facebook section of the settings page) is not sanitized before being stored and later reflected in the application's HTML. An attacker with authenticated access to the settings page can inject arbitrary JavaScript payloads that persist in the database and execute in the context of any user viewing the affected input field. The attack pattern demonstrated includes injecting an onmouseover event handler [1][2].

Exploitation

To exploit this vulnerability, an attacker must have a valid user account with access to the Settings > General page in the Fork CMS admin panel. The attacker navigates to that page, pastes the malicious payload into the "Admin ids" input field in the Facebook section, clicks "Add" to save the value, and then clicks the save button. The stored payload is triggered when another user (or the attacker themselves) moves their mouse cursor over the "Admin ids" input field, executing the injected script [2].

Impact

Successful exploitation results in stored cross-site scripting, allowing the attacker to execute arbitrary JavaScript in the context of the victim's session, within the CMS admin panel. The impact is primarily on confidentiality and integrity, as the attacker can steal cookies, perform actions on behalf of the victim (e.g., modify settings, create admin accounts), or deface the admin interface. The CVSS v3.0 score of this issue is 6.1 (Medium), with the vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N, indicating low attack complexity but requiring user interaction [1][2].

Mitigation

No official fix has been released by the vendor for this issue as of the advisory publication date (December 2018). The vulnerability remains unpatched in Fork CMS 5.0.6 and likely in earlier versions. The advisory recommends upgrading to a patched version if one becomes available, but no such version is indicated. As a workaround, administrators can restrict access to the settings page to trusted users only and ensure that users do not input untrusted data into the "Admin ids" field [2].