Qool CMS 2.0 is vulnerable to persistent cross-site scripting that allows remote attackers to execute arbitrary scripts in the browsers of administrative users.

The application fails to properly sanitize input across multiple administrative endpoints, including addnewtype and adduser, allowing an attacker to inject malicious JavaScript. This vulnerability requires an attacker to interact with administrative interfaces, where the injected code executes in the context of an administrator session.

Successful exploitation allows an attacker to execute arbitrary scripts within the context of an administrator session, leading to potential account takeover, unauthorized administrative actions, or the theft of session credentials. Given the CVSS score of 7.5, this vulnerability represents a high risk to the integrity and confidentiality of the administrative interface. Failure to remediate these flaws could facilitate full compromise of the CMS platform.

Immediate Action: As no official patch is available for this legacy software, administrators should immediately restrict access to the administrative control panel to trusted networks only.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at administrative endpoints and monitor for unexpected changes to user accounts or site configurations.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with strict input validation rules to block common XSS payloads directed at the identified administrative parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit Database (EDB-ID 24627).

Given the availability of public exploit code and the critical nature of administrative access, organizations still utilizing Qool CMS 2.0 should prioritize migrating to a supported and secure content management system. If migration is not immediately possible, strict network-level access controls and aggressive WAF monitoring are essential to prevent unauthorized code execution.