Stored XSS in Unisite CMS 5.0 Report Functionality

Successful exploitation allows execution of arbitrary JavaScript in an administrator's browser session, enabling session hijacking and unauthorized administrative actions. Based on the provided description, an attacker can then leverage administrative access to use the template editor to upload and execute a PHP web shell, which can lead to full remote code execution on the underlying server. This creates a path from client-side stored XSS to complete compromise of the CMS instance and potentially the host, depending on deployment permissions.

If no patch is available, disable or restrict the Report functionality and limit access to it to trusted users only. Reduce exposure by preventing administrators from viewing untrusted report content in a browser capable of executing active content, and deploy a restrictive Content Security Policy where feasible to reduce script execution impact, recognizing that CSP may not fully eliminate risk in all application contexts. Disable or tightly restrict the template editor, especially any ability to write executable PHP content. Monitor for suspicious report submissions, unexpected admin actions, newly created template files, and indicators of web shell deployment. Rotate administrator session tokens and credentials if compromise is suspected.

Upgrade to a fixed version of Unisite CMS if a vendor patch is available. The vulnerable Report functionality should properly validate, sanitize, and contextually encode untrusted input before storage and before rendering in the admin panel. In particular, HTML and script-capable input should be neutralized or strictly filtered, and output displayed in the administrative interface should be encoded for the appropriate HTML context. Review and harden the template editor and any file upload or file write capabilities to prevent arbitrary PHP content from being introduced or executed. Existing stored report content should be audited and purged for malicious payloads, and administrator sessions should be invalidated after cleanup.