A high-severity Cross Site Scripting vulnerability in idccms V1.70 permits unauthenticated attackers to execute malicious scripts in the context of a user session.

The application is susceptible to Cross Site Scripting (XSS) via the /admin/makeDiy_deal.php endpoint. The vulnerability allows an unauthenticated attacker to inject malicious client-side scripts that execute when a victim views the affected page.

Successful exploitation of this vulnerability could lead to session hijacking, unauthorized actions performed on behalf of an administrator, or the theft of sensitive user data. Given the CVSS score of 7.1, this flaw poses a significant risk to the integrity and confidentiality of the administrative interface and the data managed by the platform.

Immediate Action: Administrators should restrict access to the /admin/ directory to trusted IP addresses and monitor the vendor for the release of an official security patch.

Proactive Monitoring: Review web server access logs for anomalous requests targeting the /admin/makeDiy_deal.php endpoint, specifically looking for script tags or encoded characters in input parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common XSS injection patterns and restrict access to the administrative backend.

Public Exploit Available: Unknown.

Due to the nature of Cross Site Scripting vulnerabilities within administrative panels, this issue should be treated with high priority. Organizations using idccms V1.70 must implement strict access controls and monitor administrative traffic until a vendor-supplied update is verified and applied.