idccms CVE-2026-88746

Exploitation requires an idccms V1.70 instance and requires user interaction (UI:R): a victim - almost certainly a logged-in administrator, given the /admin/makeDiy_deal.php path - must load the attacker-supplied payload/link for the injected script to execute. The impact is confined to script execution in the victim's browser/admin session (session theft, admin-panel actions), not direct server compromise. Limiting factors: the target endpoint sits under /admin, so a valid admin must be induced to trigger it; there is no default-configuration, unauthenticated mass-exploitation path evident, and the product's tiny deployment footprint further constrains realistic exposure.

This is a CWE-79 Cross-Site Scripting flaw in idccms V1.70 (/admin/makeDiy_deal.php). The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1) reflects network reach, low complexity, no privileges, but required user interaction and a scope change - the classic profile of an XSS that executes in a victim's browser rather than compromising the server directly. The real-world signals sharply temper that score: EPSS is only 0.14% (3rd percentile), the CVE is NOT in CISA KEV, and there is no vendor patch. A public reference exists (an ants01 GitHub PoC/write-up), so publicly available exploit code exists, but this is distinct from active exploitation. Notably the A:L (availability) and I:L (integrity) impacts assigned by MITRE are generous for a reflected/stored XSS whose primary effect is limited confidentiality/integrity within the victim's authenticated admin session - a full-availability impact is not substantiated by the one-line description. Net: a low-priority, obscure-product XSS with a PoC but no evidence of real-world weaponization; the 7.1 is driven largely by the S:C and triple-impact scoring rather than demonstrated severity.

An attacker crafts a malicious link or payload targeting the /admin/makeDiy_deal.php endpoint and lures an authenticated idccms administrator into loading it. When the admin's browser renders the unsanitized input, attacker-controlled JavaScript executes in the admin session context, enabling session/cookie theft or admin-panel actions on the victim's behalf. A public PoC/write-up for this exact endpoint is available on GitHub (ants01 repo).