Executive Summary

CVE-2026-2965 is a stored cross-site scripting (XSS) vulnerability affecting 07FLYCMS, 07FLY-CMS, and 07FlyCRM versions up to 1.2.9. It exists in the System Extension Module, specifically in the file /admin/SysModule/edit.html, where the Title argument is not properly neutralized before being included in the web page output.

This flaw allows authenticated remote attackers to inject malicious JavaScript code that is stored and executed when the affected page is viewed by other users, potentially compromising the integrity of the system.

Exploitation requires some user authentication and user interaction, and a proof-of-concept exploit is publicly available.

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': "This vulnerability allows attackers to execute arbitrary JavaScript in the context of other users' browsers, which can lead to session hijacking, defacement, or other malicious actions."}, {'type': 'paragraph', 'content': 'Because the malicious code is stored and executed when the affected page is viewed, it can compromise the integrity of the affected system and potentially affect users who access the vulnerable module.'}, {'type': 'paragraph', 'content': 'The overall impact is considered low based on the CVSS scores, primarily affecting data integrity rather than confidentiality or availability.'}] [1, 2]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by identifying the presence of the vulnerable file and module in the affected systems. Specifically, the vulnerability exists in the file /admin/SysModule/edit.html of the 07FLYCMS, 07FLY-CMS, or 07FlyCRM versions up to 1.2.9.'}, {'type': 'paragraph', 'content': 'One practical detection method is to use Google dorking with queries such as inurl:admin/SysModule/edit.html to find potentially vulnerable targets exposed on the internet.'}, {'type': 'paragraph', 'content': 'For local or internal network detection, you can attempt to send crafted HTTP requests manipulating the Title argument to see if the system improperly reflects or stores the input, indicating vulnerability to cross-site scripting.'}, {'type': 'paragraph', 'content': 'Example command using curl to test the vulnerability (replace target URL accordingly):'}, {'type': 'list_item', 'content': 'curl -i -X POST \'http://target/admin/SysModule/edit.html\' -d \'Title="><script>alert(1)</script>\''}, {'type': 'paragraph', 'content': 'If the response or subsequent page rendering executes or reflects the injected script, the system is vulnerable.'}] [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

No official mitigations or countermeasures have been published by the vendor, who did not respond to the disclosure.

Immediate steps to mitigate this vulnerability include:

• Restrict access to the /admin/SysModule/edit.html page to trusted and authenticated users only.
• Implement web application firewall (WAF) rules to detect and block malicious input patterns targeting the Title parameter.
• Avoid using or disable the vulnerable module if possible until a patch or update is available.
• Consider replacing the affected product with a more secure alternative.

Additionally, educate users to be cautious of suspicious links or inputs that could trigger cross-site scripting attacks.

Useful 0 Not Useful 0