CVE-2020-19885

Name of the Vulnerable Software and Affected Versions DBHcms version 1.2.0

Description The issue is related to a stored XSS vulnerability. This occurs because there is no htmlspecialchars function applied to the pageparam insert name variable in the dbhcmsmodmod.page.edit.php file at line 227. A remote authenticated attacker with admin user privileges can exploit this to hijack other users' sessions.

Recommendations For DBHcms version 1.2.0, as a temporary workaround, consider applying proper output encoding, such as using the htmlspecialchars function, to the pageparam insert name variable in the dbhcmsmodmod.page.edit.php file at line 227 to prevent XSS exploitation.