The vulnerability consists of two main flaws in NukeViet's Comment module. First, the status_comment parameter is filtered before base64 decoding, allowing attacker-controlled HTML/JavaScript to bypass sanitization and be rendered unescaped in the page. Second, the checkss anti-forgery token is generated using a static site-wide constant (NV_CACHE_PREFIX) instead of a session-bound value, making the token identical for all users and reusable in crafted URLs. This enables attackers to deliver a reflected XSS payload via a simple URL without authentication. The vulnerability was confirmed to allow phishing overlays that capture plaintext credentials. The issue affects versions prior to 4.6.00. The vendor has addressed the root causes by binding the checkss token to the user session and correcting the encoding and rendering process.

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of the victim's browser session on the vulnerable site. This can lead to theft of sensitive information such as credentials, session tokens, and other data accessible to scripts running in the site's origin. The vulnerability requires the victim to open a crafted URL but does not require authentication. The integrity of the victim's session can be compromised by DOM manipulation and unauthorized authenticated requests. There is no impact on availability. The vulnerability has a high confidentiality impact and low integrity impact.

A fix is available that addresses both root causes: the checkss token is now bound to the user session by replacing the static NV_CACHE_PREFIX with NV_CHECK_SESSION, and the status_comment parameter handling has been corrected to properly sanitize decoded content before rendering. Users should upgrade to NukeViet version 4.6.00 or later. Until patched, avoid exposing the comment module with untrusted input in URLs and consider implementing additional input validation or Content Security Policy restrictions to mitigate exploitation.