CI4MS FULL APP XSS

# INTRODUCTION

This research presents a full 0day XSS discovery and exploitation walkthrough conducted on the CI4MS application.

The focus of this study is not a single XSS instance, but how a recurring insecure pattern allowed XSS to scale across the entire application.

• • How XSS sinks were identified in a PHP + jQuery stack
• • How user-controlled input flows into those sinks
• • How stored XSS was achieved and weaponized
• • How one XSS primitive was scaled into 50+ vulnerabilities
• • How it led to full account takeover and privilege escalation

## XSS SURFACE MAPPING (PHP + jQuery)

Step 1: Identify DOM Injection Sinks

Focus:

• .html() -> primary XSS sink
• innerHTML -> direct DOM execution

Step 2: Identify Server-Side Rendering

Focus:

• Raw HTML output
• Missing escaping (esc())

Step 3: Trace User Input Sources

Focus:

• Entry points for injection

Step 4: Map AJAX Data Flow

Focus:

• Data returned -> injected into DOM

## XSS EXECUTION FLOW

## SOURCE CODE ANALYSIS

Injection Sink

jQuery .html() behaves like innerHTML and parses/executed injected HTML/JS.

User-Controlled Source

No sanitization; stored directly in database.

Rendering Layer

Outputs raw HTML; no escaping applied.

Data Flow Summary

## ROOT CAUSE

Server-rendered HTML containing user-controlled data is injected into the DOM using jQuery .html() without any escaping or sanitization, creating persistent stored XSS.

## WHY THIS SCALES

A single insecure pattern replicated across modules led to systemic compromise.

## PROOF OF CONCEPT

When stored as a menu title, executes for all users, persists across sessions, triggers via AJAX.

## IMPACT

• • Stored XSS across multiple modules
• • Full account takeover (all roles)
• • Privilege escalation
• • CSRF chaining
• • Session compromise

Amplifying factors: no output encoding, no CSP, no HttpOnly/Secure cookie, no SameSite restrictions.

## EXPLOITATION CHAIN

## XSS HUNTING METHODOLOGY

This research followed a repeatable pattern:

This approach allows scaling from 1 bug -> dozens of vulnerabilities, identifying systemic flaws, and turning low-level bugs into critical impact.

## RESULTS & EXPLOITATION

CVE IMPACT OVERVIEW

There're even much much more. The key finding is that the vulnerability was not limited to a single endpoint. The same unsafe .html() pattern was reused across the application, allowing a single stored XSS to scale into full application compromise.

## FINAL TAKEAWAY

The vulnerability chain can be summarized as:

The most dangerous bugs are not isolated vulnerabilities — they are insecure patterns embedded into the architecture.