CVE-2018-10125: 
PHP vulnerability analysis and mitigation

CVE-2018-10125 is a Cross-Site Scripting (XSS) vulnerability discovered in Contao's system log functionality. The vulnerability affects Contao versions before 4.5.7, including all 3.x versions up to 3.5.33, versions 4.0 through 4.3, versions 4.4 up to 4.4.16, and versions 4.5 up to 4.5.6. The vulnerability was disclosed on April 18, 2018 (Contao Advisory).

The vulnerability allows an attacker to implant a malicious script through a manipulated request that gets executed when a logged-in backend user accesses the system log. Notably, the attacker does not need to be authenticated to exploit this vulnerability. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).

When exploited, this XSS vulnerability could allow attackers to execute arbitrary JavaScript code in the context of the authenticated user's browser session when they view the system log. This could potentially lead to unauthorized access to sensitive information, session hijacking, or other malicious actions performed with the privileges of the affected user (NVD).

The vulnerability has been patched in Contao versions 3.5.34, 4.4.17, and 4.5.7. Users are strongly advised to upgrade to these or later versions to mitigate the risk (Contao Advisory).