H18192Ho

**Name of the Vulnerable Software and Affected Versions** EyouCMS version 1.6.0 **Description** A cross-site scripting (XSS) issue allows attackers to execute arbitrary code via the home page description on the basic information page. This can be exploited by manipulating the `home page description` variable. The issue is related to the basic information page, specifically the `home page description` field, which is vulnerable to XSS attacks. **Recommendations** For EyouCMS version 1.6.0, consider removing or restricting the ability to input arbitrary code in the home page description field on the basic information page as a temporary workaround until a patch is available. Restrict access to the basic information page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EyouCMS version 1.5.9-UTF8-SP1 **Description** A Cross-Site Request Forgery (CSRF) issue was discovered in the Top Up Balance component under the Edit Member module. This allows for malicious requests to be made without the user's knowledge or consent. **Recommendations** For EyouCMS version 1.5.9-UTF8-SP1, as a temporary workaround, consider disabling the Top Up Balance component under the Edit Member module until a patch is available. Restrict access to the Edit Member module to minimize the risk of exploitation. Avoid using the Top Up Balance feature in the affected module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EyouCMS version 1.5.9-UTF8-SP1 **Description** A Cross-Site Request Forgery (CSRF) issue was discovered in the Basic Information component under the Edit Member module. This allows for unauthorized actions to be performed on behalf of a user. **Recommendations** For EyouCMS version 1.5.9-UTF8-SP1, consider implementing CSRF token validation to prevent unauthorized requests. As a temporary workaround, restrict access to the Edit Member module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EyouCMS version 1.5.9-UTF8-SP1 **Description** A Cross-Site Request Forgery (CSRF) issue was discovered in the Edit Admin Profile module, allowing attackers to arbitrarily change Administrator account information. **Recommendations** For EyouCMS version 1.5.9-UTF8-SP1, consider disabling the Edit Admin Profile module until a patch is available to prevent exploitation of the CSRF issue. Restrict access to the Administrator account information to minimize the risk of unauthorized changes.

**Name of the Vulnerable Software and Affected Versions** EyouCMS version 1.5.9-UTF8-SP1 **Description** A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Public Security Record Number` text field. **Recommendations** For EyouCMS version 1.5.9-UTF8-SP1, consider restricting input to the `Public Security Record Number` text field to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.