idcCMS CVE-2026-108815

Exploitation targets the member management function in admin/member_deal.php of idcCMS 1.70 and requires a low-privilege authenticated session (PR:L) plus victim user interaction (UI:P) to render the injected script - it is not remote-unauthenticated. The attack is network-initiated but constrained by the need for valid credentials and the fact that the vulnerable endpoint is within the administrative interface, meaning the victim must be an authenticated user viewing the affected admin page. Impact is limited to low integrity (client-side script execution/content manipulation) with no confidentiality or availability effect per the provided vector.

This is a low-priority vulnerability despite public exploit availability. The input CVSS 4.0 base score of 2.0 reflects genuinely limited impact: the vector AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N indicates a network-reachable but authenticated (PR:L) cross-site scripting flaw requiring passive user interaction (UI:P), with only low integrity impact and no confidentiality or availability impact. Exploitation status is 'publicly available exploit code exists' (POC on GitHub via VulDB submission) - this is NOT active exploitation; the flaw is not listed in CISA KEV and no EPSS score was provided in the input, so widespread or automated exploitation cannot be inferred. The signals are internally consistent: a low-severity, authentication-gated XSS in an obscure CMS. The one point worth flagging is that the affected file resides under admin/ (admin/member_deal.php), suggesting the required privilege may be an administrative or at least logged-in context, which further narrows the realistic attacker population. No conflicting signals, but note the affected vendor is recorded as 'n/a' in the CPE (cpe:2.3:a:n/a:idccms), so authoritative vendor confirmation of affected versions is absent - only VulDB and the researcher POC substantiate this entry.

An attacker with a low-privilege authenticated session lures or waits for a victim to interact with a crafted input rendered by admin/member_deal.php, injecting script that executes in the victim's browser context within the idcCMS admin area. A public proof-of-concept exists on GitHub (ants01/idccmsV1.70), lowering the barrier to reproduction, though the required authentication and user interaction (UI:P) limit practical reach to insider or social-engineering scenarios.