CI4MS is a CodeIgniter 4-based CMS skeleton that inaccurately sanitizes user input when creating or editing blog posts. A malicious user can insert a JavaScript payload into the post body, which is stored in the database and later rendered in multiple application views without proper output encoding. When a visitor opens the compromised post, the script runs in the victim’s browser, enabling the attacker to steal the session cookie and impersonate that user. This effectively grants the attacker the full privileges of the victim, leading to a complete account takeover and privilege escalation across all roles.

Vulnerable instances are those running ci4cms‑erp’s CI4MS CMS before version 0.31.0.0. The flaw was addressed in the 0.31.0.0 release; deployments at that version or newer are no longer susceptible.

The CVSS v3.1 score of 9.1 classifies the flaw as Critical. EPSS indicates a likelihood of exploitation of less than 1 percent, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that creating or editing a blog post requires an authenticated user with permission to perform those actions, which is likely restricted to trusted roles. The attack vector is web‑based and involves inserting malicious JavaScript into a blog post; once stored, any user who views the post is exposed to the payload, allowing session hijacking and full privilege escalation.