CVE-2021-47738
Persistent XSS in CSZ CMS 1.2.7 Private Messages Enables Admin Attack
Publication date: 2025-12-23
Last updated on: 2025-12-23
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| csz | cms | 1.2.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2021-47738 is a persistent cross-site scripting (XSS) vulnerability in CSZ CMS version 1.2.7. It allows unauthorized users to inject malicious JavaScript code into private messages by embedding script payloads within the user-agent HTTP header. When an administrator views these messages in the backend dashboard, the malicious scripts execute, potentially compromising the admin interface. [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute arbitrary JavaScript code in the admin's backend dashboard. This can lead to compromise of the administrator's session or system, potentially enabling unauthorized actions, data theft, or further exploitation within the CMS environment. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP requests to the CSZ CMS private messaging endpoint for suspicious User-Agent headers containing JavaScript payloads. Specifically, you can look for POST requests to /CSZCMS-V1.2.7/member/insertpm/ with User-Agent headers including script tags such as <script>alert(1)</script>. A detection command example using curl to test the vulnerability is: curl -X POST 'http://target/CSZCMS-V1.2.7/member/insertpm/' -H 'User-Agent: <script>alert(1)</script>' -d 'message=testing' If the admin panel later executes the script, the vulnerability is present. Network intrusion detection systems (NIDS) can also be configured to alert on User-Agent headers containing suspicious JavaScript code. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the private messaging feature to trusted users only, monitoring and filtering HTTP headers to block suspicious User-Agent values containing script tags, and avoiding admin users viewing untrusted private messages until a patch or update is applied. Additionally, applying input sanitization and output encoding on the private messaging system to prevent script injection is critical. If a patch or update from the vendor is available, it should be applied promptly. [1, 2]