GHSA-64rr-pp78-62ww NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class

• Packagist nukeviet/nukeviet: <= 4.4.01 (no fix yet)

Impact NukeViet CMS `, which are stored server-side and executed in the browser of any user who views the content. Who is impacted: • Administrators and moderators who view user-submitted content (e.g., contact messages, comments, or any module using the Request class for HTML input). • The Contact module was used as a proof of concept, but the vulnerability is not limited to this module. • No authentication is required to exploit this vulnerability, making it accessible to any anonymous visitor. Potential impact includes: • Session hijacking via cookie theft (for non-HttpOnly cookies) • Performing actions on the application under the victim's identity • Defacement or redirection to phishing pages • Phishing attacks via manipulated email notifications Patches This vulnerability has been fixed in NukeViet 4.5.08. Users should upgrade to version >= 4.5.08. Workarounds • Implement server-side HTML sanitization in the Request class to strip or encode dangerous tags and attributes (e.g., ``, `srcdoc`, event handlers such as `onerror`, `onload`). • Apply a Content Security Policy (CSP) header to restrict inline script execution. • Ensure cookies are set with the `HttpOnly` flag to mitigate cookie theft via XSS. Resources • Affected source: https://github.com/nukeviet/nukeviet/blob/nukeviet4.5/modules/contact/funcs/main.php • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html