The flaw exists in the admin/member_deal.php file of idcCMS 1.70. An attacker can supply input that is processed by an unknown function, leading to injection of malicious script. The resulting cross‑site scripting allows an attacker to execute code in the victim’s browser, potentially hijacking sessions or carrying out further attacks. The weakness is a typical reflected XSS combined with server‑side template injection as indicated by CWE‑79 and CWE‑94.

Only the idcCMS 1.70 release is known to be vulnerable. The attack surface is the admin/member_deal.php module, and no other versions or variants were cited in the advisory.

The CVSS score of 5.1 places the vulnerability in the moderate range. No EPSS score is available, so the current exploitation probability is unknown. The issue is not listed in the CISA KEV catalog, indicating that no confirmed widespread exploitation has been reported. The attack vector is remote, inferred from the statement that the exploit can be initiated from an external location.