Summary

Vulnerability: Stored DOM XSS in main landing page via System Settings – Company Information (Persistent Payload Injection)

• Stored Cross-Site Scripting via Unsanitized Company Information Configuration Fields

Description

The application fails to properly sanitize user-controlled input within System Settings – Company Information. Several administrative configuration fields accept attacker-controlled input that is stored server-side and later rendered without proper output encoding.

Affected fields include, but are not limited to:

1. Company Name
2. Slogan
3. Company Phone
4. Company Mobile
5. Company Email
6. Google Maps iframe link
7. Company Logo and other media-related fields

These values are persisted in the database and rendered unsafely on public-facing pages only, such as the main landing page. There is no execution in the administrative dashboard—the vulnerability only impacts the public frontend.

Unlike the same-page stored DOM XSS vulnerability, this issue executes only on separate public-facing pages and not on the settings page itself.

Affected Functionality

• System Settings – Company Information configuration
• Public-facing page rendering (main landing page and other public pages)
• Storage and retrieval of company information values

Attack Scenario

• An attacker injects a malicious JavaScript payload into one or more Company Information fields.
• The application stores these values without sanitization or encoding.
• The payload is rendered only on public-facing pages, including the main landing page.
• The payload executes automatically in the browser context of unauthenticated visitors and authenticated users who access the public site.

Impact

• Persistent Stored XSS
• Execution of arbitrary JavaScript in visitors’ browsers
• Potential account takeover if cookies are not secured
• Platform-wide public-facing compromise
• Full compromise of any user interacting with the affected pages

Endpoints:

• /backend/settings/ (Company Information injection only, not execution)
• Main landing page
• Other public-facing application pages

Steps To Reproduce (POC)

1. Navigate to System Settings → Company Information
2. Insert an XSS payload into any Company Information field such as:
   <img src=x onerror=alert(document.domain)>
3. Save the settings
4. Visit the public-facing main landing page or other public pages
5. Observe the XSS payload executing automatically

Remediation

• Never use .html() again or any innerHTML-style like JS in your PHP, or any other sink, even if user inputs that flow into them are not clear, they still represent real world danger as an attacker can make use of this to exploit the application via XSS. And do HTML Encoding as much as possible and always do Sanitization, theres no sanitization there unfortunately. Also apply CSP, HttpOnly, SameSite, and Secure upon all application, they reduce severity of XSS & escalated-CSRF via XSS and do great jobs

References

• GHSA-5ghq-42rg-769x
• https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.2.0
• https://nvd.nist.gov/vuln/detail/CVE-2026-35035