The idccms V1.70 web application contains a cross‑site scripting flaw in the /admin/makeDiy_deal.php endpoint. This weakness allows an attacker to inject arbitrary JavaScript code that runs in the browser of any user who visits the vulnerable page, enabling actions such as session hijacking, defacement, or theft of sensitive data. The vulnerability is a client‑side flaw and does not directly provide server‑side code execution.

The affected product is idccms version 1.70. No other versions or vendor information is provided in the data, so the impact is limited to installations of this specific release.

A CVSS score of 7.1 is given, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. Because the flaw resides in a publicly accessible web page, the likely attack vector is a remote web‑based exploit that requires a victim to load the injected script, typically via a crafted link or email. Exploitation would succeed against users who visit the vulnerable admin page, especially those with administrative or high‑privilege roles, making the risk significant for environments that expose the admin interface.