CI4MS, a CodeIgniter 4-based CMS skeleton, improperly neutralizes user-controlled input in administrative configuration fields related to company information. These inputs are stored server-side and later rendered without proper output encoding on public-facing pages, leading to a stored cross-site scripting (CWE-79) vulnerability. The flaw affects versions prior to 0.31.2.0 and allows attackers with administrative privileges to inject malicious scripts that execute in the context of public users visiting the site. The vulnerability has been addressed in version 0.31.2.0.

Successful exploitation allows an attacker with administrative access to inject malicious scripts into public-facing pages, potentially leading to theft of user credentials, session hijacking, or other client-side attacks impacting confidentiality, integrity, and availability of users interacting with the affected site. The administrative dashboard is not vulnerable to script execution. The CVSS 3.1 score is 7.2 (high), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade to ci4ms version 0.31.2.0 or later, where this vulnerability is fixed. Since the vendor advisory indicates the issue is resolved in this version, applying this official fix is the recommended remediation. No additional mitigation steps are specified or required beyond upgrading.