The vulnerability is a stored DOM XSS in the backup module of CI4MS, specifically in the filename field. An attacker can embed a hidden XSS payload by tampering with the filename when a SQL file is processed. This flaw allows the execution of arbitrary JavaScript in the context of an authenticated user and is classified as CWE-79. The primary impact is that an attacker can gain full control over any user account and elevate privileges to the highest level, effectively taking over the entire system.

Vendor ci4-cms-erp offers the CI4MS CMS. Versions affected include 0.31.4.0. The vulnerability was fixed in version 0.31.5.0. All installations running 0.31.4.0 or earlier are vulnerable.

The assigned CVSS score of 9.1 indicates a critical level of risk. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector involves uploading or injecting a crafted SQL file that modifies the backup filename, enabling the stored XSS payload to execute when accessed. Because the flaw achieves full account takeover, the threat is significant even if the exploitation conditions require some level of access to the backup functionality.