Security Research
Explore CMS v1.1 Reflected XSS: How a Community CMS's UserID Field Became the Attack Entry Point
Thinking
2025-05-15
5 min read
Research Dossier
#Vulnerability Analysis#Code Audit#Web Security#XSS#Reflected XSS#CMS
The user/login.php and admin/login.php endpoints in Explore CMS v1.1 perform zero sanitization or validation on the UserID field — an attacker can trigger reflected XSS with the simplest <script>alert(1)</script> payload, stealing sessions, cookies, and email content. This is especially dangerous for community CMS users.
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a4d4b6d4ade7253d06d61bf923572a6b8c253d117e8b63642be9ad8c68eaee7d4a02592bcdbd3155abcc6a953135deec61ed6729ad92ae056a76758beba39e372ec69ac835344341af6a14cca01a5e72db27419d843d5988f7ed78e2dba0865c6562c537ed8f995d98180c711dbe4c9a2152cf6ac30a7985e067d6676825a639e396faca02648688eabae474f4cd63265c60470f3def59a35e31af0799b6fa902ac61e36b932a85e0e326f5a6173955a4e19d37b78233c90325cc3e682631be7f1e71f149d2a83a7d032f9698495d9fee767b9c1dd984a49d5b467ae547e17d00902c5c75cdd4701bd790b7f1042790c2db8b4dadebc20f68cd70b248c8fac076a4f8809bf807dd06913c19614a8bbfb4fb251cf6f6142d9ff76c44b6ce89baf293b9f8c6bcd9a4fe56ff320c261f7e3506adb72a968f1a3a7c8fab9efe68be790e8485c1413d5c2f90941aafc8d44c8ea262123bdd522f437f9ccea7d51776eacac3c16c0d7d356c8204db8e28207015579c4d82ac4b9e63d27aff45ddd6b0a58aaccd62d1e15e5f7ff937606633d683fc89fa71611e838d6a0f84f355b797171b8d8f9ee17b645d85c79c4d24c548b2926d6447264d0be0656f4c3fc25590149a8cbe5d7a395b0038626820a0774ee15f6e2273c23ade987b5f1c5457b39c373029182aa2eda1186e609854c8cb0d3108f981a697212c597f1d39051412a955af735cdbd43dbdc029659a11fc8d4ee40943f2031affab0ae39edb6f0614031f570458117490afc071e1362d0b876ec4271054d5e30381e5a41919caf5f96d3090fe44f76cc27b0bc96fd2dd0ab2caa75a850b1d2bea422ef9fe5990cafef133e1355d32e7d0e0d837a3b0a8ba103dbc62bfa2514a17feca08e7b513b03328362390d5b6b8ad2faeb182aeabcd7f463716b19589fb3774b59e5423487d8786514af22e0b8e4df1bdd6598d6bcf49f43a524be5336e12a509f378f4796ae99935342395a2ce412b397d12287819a16fbcc4b6b196ddd5053223fa68ad9584c3b5d0087050c21465b7934f180fa935a70423af3577a8683d80486dc415db49bba2dfef2b72f5bfc064fee6a6375f63a5edf7ebf85b2e9b8a05203d1fadb3623f3ff5e788381830a6821ce570d6195feb3e4323b05f569d74ff5f1eeba73d2b9766d50852601579df3554fee9fd4567c35b2913338367ae7ea0785d060bd525c7e330bd95196b4044dc7bdd38a1300c3fe49273e6216b28d806d38dbe0cb43375840b0c0515e7b4f343820790b4e543e021e8735998d7c70dbad801ff756e31738d0422d9849dae287ebe3140933e4dd854792937e405f91221b62ed5d862b2c2013126239dfe349368e33a425736442459ef9f84f031dd951ce571cc370ee2f8cce9bdbe57377578170d6aa857e645874fdf9d25f217ab8637fe6449202d77d49f1452d0925a6960565e79d33e180d3b486bddf46b1685cf71c988ee16d01c1be0c6560115334c28692362fef5651bfe22b0be5bcb316a16abf2e23e7e61a78d7343c2f85270b3cbd093392822e319e2c771d7216f0d32f2bca3cd6423bfcc05e3fcdfc18e923e383a4ef36dcd1bf7907003c2c87e868b6a4eb560678751747d055998b5767946e6858b7b7a733c493a86dd9b527fcec44aa71fef105874cda0e6ac8c5b04bc8aab6115cd3ce62b4e5aaa28e51ac042bdcfe2da53ee49bcc9d0541b81d1cbead7f13df01ab369d8d47a54ea715b56f10179acb776241630d347ee306009d45e869c97ddabf707927ee89daf14e27033c39a3594b64e3d877d5a4460cc8c1e1b6b49bbd8ec8d61fd097e62109e1f12596ec6b5e11e60fc1cd0703ff5b9a4569e901f5a37c9b2604560ad4e6d953b5635d171c7d596d82a0012864ac4224143848cbe9fc04185f1769db50d96509b15eb0bb08184a53fd6096d489479e8f3262ca87c7d7201da26496d3d98ee3b94b02c0249ec92155a4889578fb415870ec0422219f03ab7edf402f29da7930fcd1d7e74796c2091108e4b690b2a98773912698291983911f7f840d76a5638aa1cf15330c2baa196e0c0c673a95b4da7343556f1f635b699fde1d507511d18cd33d9d717844358f0331e3e65239ac2e737f4a9004102f17d2a2b7a1245e108a150687ea303c1f545d46ad650b6ec606ca13bffc47bd235248868306cf2335b58ed0f7b34baabf9df400f91260eb156c389819673cbb5b08e6caf1c3136dd9e5b9c7dde99f57e62bc69e9fb6d26dd060e7c5a6b409b4283f77d34424938e414e6b7773d741a52d18a0ec626dbe9e87b5484e2841950efad163767e392f778fad656cf9ee28f4ee3788676d4b774ebb45b7a62ce61a843eaefcb02ee12392f56053777f1083966c268fb4ea69ca97e7017cafa3cded251b7da55fe18097cf17f2b7b718d060c4dbaba92f007482af3f421b2b0299aec8e68862998c21f812a3c8c945da30a3770d189566ac896038549acac673fc400f2a3a749631a2386f0a9e6349050ce553806f6d15b783fd0df907082aaf601a3e7ae6b9107b9f222ac0221a64cee2d0a1d538049307ce4fe3748d85c210b058d22d0e281cbd45f3bfc74dcdb90e73cb9cba6e08e7e471c7df9ec809c8f30e05895f64c07a4004663573e3dfe3559808f86970c3a92b999f5149ff886fc24359b4a1b4424fcacb99eef9f6069537340b6b5e3bfcd22cf6148862a65900941bf4a735cfd6d4daf60423b28e176f91be4e6672269e7438376aedb0142a69f2a093f3c13108c9008e8401f859fc0ee90a45350904ad5a2ab0ff5a8ff81d1ef5919250b9f1995bf7f04d633f3ef30402a70f9904a2d6457a1adab2f8b6b8881407c437795b952520fb1c7d1638aef4633e179e1f40fe2aede845a711986fd75f94c31b98223cd078597cf753a3e2f155d9d51c07c62f4cf5c8ac6cc955c7198025865560d34e4789b95ff0a78c576834cc6f3fd72d5b8bdd33d1ab6197b366767799aadf7f7b0fee04b9bc2d4ad7940c103f115313bfedd08800560a42ca48338e2b955e98516cedf2caab7860fce471d505604e5f68465b565e1beced864db5d65bc987688e36f457a108bacf3eb7b890db6663201349fc01325ce08ceb4f38c09a2ec36dcac59f04e723c3755798a627029bc4c56e71865cca6f36138f6b14796178aa9954d9c3dd8aa875578c478b0e7c3817c39a2b8d1faf95f8c157008bcd436c627d419fb785280abaf43a4d9b5f21171b80c8c8aa55253e16a444785295196580aae9245d80da68ce51b3730b361cfb32eb57523659a8b92e3bd7286c692a9f42468b8687068131e872a6a3981a0ff93f4d50f3c11e42bbc7998a3f3b1110c012eab4293ed9943599596155e01d2d2c506f7b032e3b11a05e15deb0050af9bdffcfbd97a6ba0502613d786eaafeef4d7940b96de8fdbf249d766f68cb29571b3463eb96ad8d8b548b0de9aaa971ddf59c62c6650ee08d511a8a90827b78eb5ecc80ac812db45305ba57cf7daf2aab293090327fc2cae3ae6b7321d537c1dcd203c8138397812d3c5371b15212a438fd0738d9c273ca3b342e36fced0d7f17d396f0990a725a58a3d1cc4ee7f99cebfc8722e05cb383864d2f931cb39356f7cfcdc6b418dbb15088e5681a97ec89ee8c81df2d56822272e12aa7f7ff1c2313f2aa664efdadddd2647b2e8bd6c0a26714097ff20e530f7e67bb6a9231c1cf9ac20f2d4368f5e976283d72a9256d202209eb6fa0cf84f8f894e26e8005f1ba990f3f0d8ea48a8b9771ecb5a2bcf16684775e14632699f0710de524d87207ccd8089d36d2157a2649321bbce9bb672f821725245580c02c5fa3d2b2897583ca5fbe3782d5e9e4218d74831cd2a64dcada7e56142e7d6b0fab03c611be6b120be6339a8c978bd6a36b2e9d2edc76269bf0cf43fb420af6d8a13571c3a9136d448510207cad3e5e7f077b8271c4c2d5199bc2c842c04bdfee2546b175bd51c6aab243fa68272b1ed7cd54297c9b97ff0b9ccd8dac84bcfb185045a4ffbe18ce41d3f2c2ce5eec061a1c8f94049ea56aced1e0697d94b498d853faedcce6dccd569286dd4933c310aab711d6e4318809dc0ae3f92b5c1b7d9ba983f1154a39d4efd26571c3246eb1411800be118e989d85651b56393c4583c091358381fc5f59f22505441bb6ee11d117a0e53c21cacfbf46713c6cfc254e0f3cd900e41242db6b72eda9c39f5970ca9395a527d78454b92e0dc647f22e4019985a418138ee470512c54a9ef255d5b653d463294e32366f78545773dcb9c15f9387f6c9d4f75c83958043ce9a8e460c2bc484ac64568e9f77e878e47e82845b1b864f9c3bd015d18296cce2aa43c8067e91ba4cc61be9d9918a02bc303cbcf8c2b7133693b315ff0ebb132630bf65e221d9ca8d854271ae87901520d3a9e3c5256ef8b3e9439ba8fdcdcf7985ae2a53ec0674e8894a0f71d85d4a209067c1b9a8d5d687e70b5c865155bc7698e79c9d415d28537104857203cfdb29e4db77c206a163b7b1ba98b865e5d1db95ab88eca24fee91f88f866ae776178ebafeaeae8fc07ce10d9b904cbdac64682c36ede7e00c5fcc3b63a6d2d8a3cd05e04ff5e6c50a91525409ad6746c19ee39953120417ba2f0dbc4a8afb8c776afe96cca535f8b1ac5e60c8e04c56c93553851ef9dd23c9c0fc44f1c05c32372899427c3f50a398da0789a95dd5f1d55474ebcd5d2cbf2086a1f319e4b83fe9db2bfeb6c520d6dd9d8b3e14923256701a4c44ecd0dd59ffe4b782cdbfcf953024fccb17a55e6049ff8a47d4ca3d94a759af094ce01e661d327f4fbe82856be0fe9c3034e6236bd11d066a093f9ce8986e85f056ba4b4178cefe1fbac453aa3ad34a403c4bb888bf88a5045ebf57cfaa5fac4a6c9a959dba5a5ba59b8e329fd7251b78715950b39baafc4e741f2e34fdc57c4b58cbe4b8cfc668d7354aefa1c613450a7b31f7db6ff9660d6175ca7ad2665cc677914cf94369b96acb98f4ebbf472de8e85ec12551ed945b80447ddce5f35ef8356a2f901c9da29b67d1e2542fd7fee613c75095092facff7f780a63f120f138644b6ac0c212278ca3a5ef6e04951482b60f9312a1af028c0cf235cdf2fb7142a87524dba345bd7dfeb991ef82737782b824bae01354c53bccbb997c4bd8d03e3b719be507b08537214a4e21716732753e56fd95fb93f22090964231855c476b6ed9de883ef7cf2aafd0736fe0ab36aec3b5424bc98a454a63b88e8dbefc84dde044d0eec0370c1abd79bcd5b5eb461be932ced00cc00d5bc15fb264b319793edd3b9632e3d0e5d6a376c2b7cfebb97625eea37ed7e1c9a4ecb087b4c6d3f75dc5f1439f496ccff51d0d770700df68af8f428f35403d58282d24459b3667edfa6701581e3681cad28d79f2681677e29b115dac038cf4b76fe9660f47e7ec4c22eeeef2666a4986e979328381193d18aeae5f6b08ee97c2736a691941434f51350cfabe80b9d4236dd45e743dc0148b85d2bdaf2e0543aa23797e658da1d0bb5f89421dd52557aed501255e66bbd0e364bbdff6f6d6cbd038e03c2eed786baa28ccc68650dfb65adb1b74a109d3ece99fe5720662ead9f5dd0a5d65f3d75328862971581ba9ea6c83a68650c67e82ac67455cb9226843d890312ca96cf5ec4270793540f70fd7cd44370a43dc9127d0d332bd9850c8723c5111dab3294cd2c185186eaeefc8223c2608ac9a629d339962b14cfe7fc3f14208416b113b46518e73da61d3f32653a7e19af68c31e614bc2d342459648cee3bfb7fe53908c912314958411ff53aa3dcec82b5fcfaf176a0d161417ddb4c5fba432e7e13b96ee489dd93ce58642b12ff970f6547f0533d7e2ef17ee242c5855bf149bbe672d81cc65d259e347e6d17630ba34381910dafb59eb4d8cc64305bbe4829b57bdd76b85adde6d935b01e495eaddcf88940478a6c21e4cdce176c0fcb977ea69e73c1a882de2882a077891a26b899387085dbc7dd2092627e3b87bcd866bf4ded4e59c7e8feca6006e5dd89dd5670714742a8a875f2a1e17218e56ac9988509ea56e7cfb0c278d8014969307087f046dc3928c260d1ce6183b736c085eabec8a3c1e36eb343dbe6ebf1db479f1a0848173b516f87828697559a05ebc7083e58ecafa82b2f4beb9e058c30ebd1e4d8b0ae14c5cc57876b4685a35a61641f4fca3e8e951ab23f9a512817b3f20a4e448dd1804bc382c8f07487281ca0f55a1e84f138929e5201247a8ed43ea2c88703fb81697631e7d1f2f6d2074817d63b095d6fd210321f1bf432e0d6d2e6585435dd98a9c7f271945c92bd5b0ddee337e6a2bbdf03a4422bb24e6994dc7ec8f3375d1c87a963740af692583b0950b865d465209976864643f67b083d81509465a10b2bbef83eaf1ca40dc35b251f7419ebeea6d17f6d1926868abf54d823ffc4a004765316df32b438cdc528dfb1bcc924ce8750a501b63098e284be3c92cfd311decd5001d29226d9e42870c9a1a7bd99e71fb2d15757c86d6a4658ccb6e3e38e69c9c3574873a20e038884ff43c5cb1587723599b8d4868ca07f5239dcccfbde705366a2f7baef9ee7a0694f19cd0490a3a78629fe6d423f229f4937abca2c48c3bf64b724986df989c64a303a0f1df17616fa64345d40afb74586c74d52bd13bedfb778c0944d4053bc3723522195c08a9b7950d2e425ac6c5d38d845625a55e66c2ea1c1ad4ce524b1ee52e4b20d00b970da6f2586ef1b695887ed22ccd156164232585dada7268e1c0259c72e7bd12d469b1728a123a1d9f94f97c59d27c2a7be3e8d846526beeb85e268a71086a01795574f0da5577faaeb63ccb6398be38b57343c99a09af57cdc3df7cb5a5be70d9073c99a3c7630a15f806d8126296f7f8cb0664142710abaef95a2926b0a500662976c05bf13269fe38f05060d3e9036ed2e012493b39c50bc998a7d52cf246bf87efb6b0705d0e000f9c794f5dc1631483ca5e5f7276033a176ad7bcd0c6611d1086444073457d4a8dcecf1f7122fe06f04fc6aa277c3a8d29f642462ef1b6dcad8c1347732377a2e6a2f79387f65188acf2f8d78e58255e88d5f1422cf702703461c657180f6db2ff2f5273f391857b176cd315755cd48f52c5897e2518bfc69db7417c5977d9e079b53135ae1fb2f51f53c541f75f25c75951a8527f242f2b2f017427d384cc7828aecc0e39d1e9d8bc380c59e60cd6f3ac900d6642206e734add41ffa17bf978748ed06a36a0d945dadbaab1be5ba0c1d479849ba2c6336996cffe960929c256542a0f4932ee75dfcc6e1b750388a14f77997921ee47c8b094eb14080c11a0d7874f7c0d6f94bbf5710fc7cda3008d49f288327819eea4a14bea8bcf89dfa245b5ce1ca96302240a1b93c2fc24eb5f86bbfc36ab1b05ed957b689b9b41631dd7d15b5ddb9f54b97ce4b43c994ca75881bddc3b4b5da6d6204a47069f5e8757f1fd5b6d9d4dfab148604901718366eb7aaea877f35419db75c0a8e8719c56265834e5faa5f4343ca408d6512ca7eb2d822e761f07d267300cc177940f0802bc13ae8c8c8a2167019f1aab42b6fb99727aef7a98f618e2c0f33a5d7ec0209165a1ccd224e40c8a28b1a96fcce72f9922bc37767a86cf582c2f3abfacb121eac4e0a4065ab5b5d8be16b3cc5913f507f7f4f97e712509562b323fadfa27393897795db7e3f5b7f3808e480695ddde4ebcd5098e4764b2d2567e28a6baaf77dc7389845fcfa3aa8ebfec99119702cea1147e14e92d7998b6b57e97f3f43831d2dbbc032f6b2aa15a2ee6974f66d663e293ec6b3b51d40563c71102a57478a53239d902ccae4dc0e9060198a7f9f8d8af1aa4bfe756350cdc48197a0b062fc79b8a1f6cd1f15493479f3dec63fcc96ef46b49c379ab682ac521d00c740342d14e9b4a8d693bb2129cb985225e062bc4ef2e8c0616f17b76a77eb08b569cd67c66e3682d9904b830c40191d910ec4b7497d37d7b4cd06ede723c81e69cf51cc0fb4ca0a6d0b32e511a267d226ae798498d081abc88e607d0bd7baab06c698e2e765471d74b7bcee44f143dcf8268acdcb91ac9ff28de827fe097467b4d683a3136a7d0c9f2fa6c9fabecb9e2eaa0a7232e94353d75bef956f79b9117594afdf47f67991fedf9e0bf90e4f365224e951f5ad34fb0479d3e5f914d115e2ea6abf39ebf16a95f5bc8483f7a9dd311e4b9389caacac5c956538922a7884bbcdf38638a830e328dca290f5568d6a9e95e3f43bb4a3d533fbec4fe688660c42045ecc1722e6dcff1ad5a93a07f7d27fd374800c04ec357ef6c875abfca726d75e51127b28d13ac8e84e09f04dfd8ca1b12ccd89a1cba08606915d46c5269715a16de6b68a6c773c72f0d78857c8010fbc4b0501d6b26f5399cffcca37be284929fe8a0739e6ac29eb1faba8bceced43cbcf0efc4cc379c1f913dc21114c4ac01165ab436af78734dadfae04e9b429d68297953c03b9aaa2efcd31914e8e2cf6e8ee107901e60b1e649f193ee2650eea382ff30d03a47eac84b465e3bea3b1200d82ab57cb403c8857338f789a7f047d441796939301845c4759360c3102b794f6a2bb7d01dbed3b2e6eb4f64c78d26fe93e720adbc3d769e53dfe0774b3c8c04dd701b26e5ff693f5c0261e02e6ffe46a19e798e5b0497156771bf50351ef270e4c2cc5fc3567167da4bbfe50d3025f4d4a09f0a2d2667022e46e729d36b357901358cb8dc2d8fa26d4187c15b89360ce323a0607d99d0e89fafc564df6a2c1fea62129666749c0b8dc2a2624e2adfb95abbd6ac24ea595b6f2a9fe6db204e7542d102ea0abd28c07e44ea2f0c2883d9a03381288a76d266c9e3b2032d579a1efcc8e038de589a7c69006b9cb037832892d88a10c364b606336cfe60409d1e859e14185f70f3c3b593cac89fb9d54f2327ef42c9553e1d1c0a002bc203d048e71a243a07ebfec8c7e8f1743cb185b278940176ccee2d188d28e75a2a0bb74a428adfdf650fea1dcdb864e4294488dff87fd81c9aa7a37bdb6c15a3f3758761fbeb90004a1d58ed75e2f377c2f5d18c2cb9580990a97a345d5ba0c54ac568d824a170b6346084aefdb710d6e866497ff0757626333b297c247b5c7329555a600e8e53c69a78e61a33f30610e4bd406060d19a0b71c711c66a658baf3c42c110a3be5767fa5b545ba5120c1cd2968957be4dd4cb0f22a5faa3f76db155b5f5344dd6fabafb1ff934692218ff287e733d2a0727953f5e95ca11762a5a1325bd30ea285883976ca18a959d388c23f347a8f16ca31ffe4661d422e7ee977cbf95c54883872cc4338c861da8d1cd39a78fe239636c8074d5a44783767c4d7e287f6ea74b05a7af83d78d6848d5890472e9f0ae23f19e399a7152da3cb4dd25de7a33363110a3a05982ad5b8ef5cbc8b5959b4672ed2dacd30ad25a39ee275475de650a822d0717a58109899f03a18ac04480eadd65dfd6b9aeda8245101206c7d776642d08f687876b5d6c71d0b30c47071f76a50ddcaea43fcaed21f3c538fc25e8db1dd89040f398f5ef1b346c58871fd83e4e0a44e2e97f385374df75b1ffc1286f765b02259001a58a59b9805f229e1386558a3fac78c85a7ad0a9b615695a7d38c03c76427d0fa31889aceb0eb591e3d39983c3c1fdcb27f30229746bb59ddde3f3f03fe73389fe0dd6f7fbebcabae8f6187a7a0f614091871288c2f033802d537fb538801006bebca4d0bb8992677474ab77063565654adf849f5693ed30a233bb87a3494d50cc2f99550cbe1f2335e96d387d9acc96d91c78a704efaae9809e1b84978a14f17773098a62da647e03f762475a82e67603fdc3364142b49ebafde0e1c9303c26c31ffd163434c30396b9e2bad1edec2708364d6726d2ea7942a415aea3f063cc28bf7baa6046bb3ce679dc8ec89a0aeed955e642a3e39e135a3da3075863a5abc7ee1be4b67b3b4c4a6f8cab807b7219c5b6a2fa27bf6c66d237cbd50229162034a773c134f8ccb53076700edcd973282ee12fbf36bdaff77c651202d69aa0d20d2b73e05c416063e089349610257d880bf98de54865da1edaf13881ee4a78b241e5199354117f1137625fd4bcd1886a5f2f7f3307cb670cf13f7c1260443bb76f5c40eea4c44eb4577129780ada9ae7a195ed7df20aab71a74598139509abfe25fca8245d025442f3a0dd974efac83c9255e913202c15daf4586aea04f4a82ff1a45edee1189b8b97937d4a1ee511fd170bca9548e7b62553ef07e1c982c6b96e7663c9d85d6fdaa05a2a70402dc454ca00ea1030b3ccd61c6b2db52942516f248799165fee70acf92f0f2f08c3815446fcf0fbbf56747407ccd3a1b68d43ec7b9ffad019151879477dd1411daf04aacdd152eab4a4c311971235329e55596b79fc5c8f93361926d6e6234a2043316db0af7e76fb52f849b3b00a48f9c44b59ef431750bf1f20c5d390492c548b9733216ac2fb029f47399816ce46a56d2d5b7975168334fd933a07e091b176b8f7330c5237255040527c345c26f156eeffe4a308bacb23ec22dd2c5c3abcc783ff6216d2b668298670ea7f6d924d07acacd8b06d7228f4cdb