GitHub Security Advisory: GHSA-vr2g-rhm5-q4jr
Package: ci4-cms-erp/ci4ms (COMPOSER)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-269: Improper Privilege Management
Vulnerable versions: <= 0.28.6.0
Patched in: 31.0.0.0

Summary: CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

Details:
## Summary
### **Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)**
- Stored Cross-Site Scripting via Unsanitized User Name in Profile Management

### Description
The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

### Affected Functionality
- Profile name / full name update functionality (both the 2 user inputs)
- User profile storage and retrieval logic

### Attack Scenario
- An attacker updates their profile name to include a malicious XSS payload.
- The application stores this value without sanitization or encoding.
- The payload persists and executes whenever the name is rendered in affected views.

### Impact
- Persistent Stored XSS
- Execution of arbitrary JavaScript in victims’ browsers
- Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names

Endpoint: `/backend/users/profile/`

### **Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)**
(Required for the chain)
- Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces

### Description
User-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.

When an administrator accesses affected pages, the stored XSS payload executes in the administrator’s browser context, resulting in administrative privilege escalation and potential full admin account takeover.

This issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to:
- User management interfaces
- Blog pages
- Other content or UI components displaying usernames

### Attack Scenario
- Attacker injects a malicious payload via the profile name update functionality.
- The payload is stored persistently.
- An administrator views the user management page or any affected interface.
- The payload executes automatically in the admin’s browser.
- Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.

### Impact
- Stored XSS
- Administrative privilege escalation
- Full admin account takeover (including other roles)
- Full compromise of the entire application

Endpoint Example: `/backend/users/` of User Management Page

## Steps To Reproduce (POC)
1. Go to Profile Management page of the User
2. In the 2 user inputs of the Full Name, put in any fi