CVE-2026-2934
Cross-Site Scripting in YiFang CMS Extended Management Module
Publication date: 2026-02-22
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yifangcms | yifang | to 2.0.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-2934 is a stored Cross-Site Scripting (XSS) vulnerability found in YiFang CMS version 2.0.5, specifically in the Extended Management Module that manages friend links.'}, {'type': 'paragraph', 'content': "The vulnerability exists in the update function of the file app/db/admin/D_friendLinkGroup.php, where the 'name' parameter is taken from user input and stored directly into the database without any filtering or sanitization."}, {'type': 'paragraph', 'content': "An attacker can exploit this by submitting malicious JavaScript code through the 'name' parameter, which is then stored and later executed in the browsers of administrators or users who access the friend links list, leading to XSS attacks."}] [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability allows remote attackers to inject and execute arbitrary JavaScript code in the browsers of users who view the affected friend links list.
The impact includes potential execution of malicious scripts that can hijack user sessions, steal sensitive information, perform actions on behalf of the user, or deface the web interface.
Exploitation requires an attacker with enhanced authentication privileges to submit the malicious input and some level of user interaction to trigger the script execution.
Overall, the vulnerability impacts data integrity and user trust but is considered low severity with a CVSSv3 base score of 2.4.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by identifying if your YiFang CMS installation is version 2.0.5 or earlier and if the Extended Management Module's friend link update function is accessible."}, {'type': 'paragraph', 'content': 'One practical detection method is to use Google dorking with the query `inurl:app/db/admin/D_friendLinkGroup.php` to find potentially vulnerable targets.'}, {'type': 'paragraph', 'content': 'Additionally, you can test the vulnerability by sending a crafted POST request to the `/admin/friendLinkGroup?callback=ajaxRs` endpoint with a malicious payload in the `name` parameter, such as `<svg onload=alert(1)>`, and observe if the script executes when accessing the friend links list.'}, {'type': 'paragraph', 'content': 'For example, using curl to test the vulnerability might look like this:'}, {'type': 'list_item', 'content': "curl -X POST 'http://target-site/admin/friendLinkGroup?callback=ajaxRs' -F 'name=<svg onload=alert(1)>'"}, {'type': 'paragraph', 'content': 'If the payload is stored and executed when viewing the friend links, the system is vulnerable.'}] [2, 3]
What immediate steps should I take to mitigate this vulnerability?
No official mitigations or countermeasures have been published for this vulnerability.
Immediate steps include restricting access to the affected module to trusted administrators only, and avoiding interaction with untrusted input in the `name` parameter.
It is also recommended to replace the affected component or upgrade to a version that addresses this vulnerability if available.
Implementing input validation and sanitization on the `name` parameter to prevent script injection is a critical mitigation step.