CVE-2018-16725

Name of the Vulnerable Software and Affected Versions baijiacms version V4

Description A security issue exists in the software due to a Cross-Site Scripting (XSS) flaw. The vulnerability is exploited via the id parameter in the assets/weengine/components/zclip/ZeroClipboard.swf endpoint. This issue arises from the non-standard use of a flash component.

Recommendations For baijiacms version V4, avoid using the id parameter in the assets/weengine/components/zclip/ZeroClipboard.swf endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the ZeroClipboard.swf component to minimize the risk of exploitation.