Jiguang

Name of the Vulnerable Software and Affected Versions: WUZHI CMS version 4.1.0 Description: A persistent XSS issue allows remote attackers to inject arbitrary web script or HTML via the `tag[pinyin]` parameter to the "/index.php?m=tags&f=index&v=add" API endpoint. Recommendations: For WUZHI CMS version 4.1.0, avoid using the `tag[pinyin]` parameter in the affected API endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: WUZHI CMS version 4.1.0 Description: The issue allows for a CSRF attack to change the password of a common member. This is possible through the "index.php?m=member&v=pw reset" endpoint, which is vulnerable to such attacks. Recommendations: For WUZHI CMS version 4.1.0, consider implementing CSRF protection measures, such as token-based validation, to prevent unauthorized password changes. As a temporary workaround, restrict access to the "index.php?m=member&v=pw reset" endpoint to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: WUZHI CMS version 4.1.0 Description: The issue allows for persistent XSS via the `form%5Bqq 10%5D` parameter to the "/index.php?m=member&f=index&v=profile&set iframe=1" URI. This enables potential attackers to inject malicious scripts into the application. Recommendations: For WUZHI CMS version 4.1.0, avoid using the `form%5Bqq 10%5D` parameter in the affected API endpoint until the issue is resolved. Restrict access to the "/index.php?m=member&f=index&v=profile&set iframe=1" URI to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.