CVE-2020-17551: 
PHP vulnerability analysis and mitigation

ImpressCMS 1.4.0 is affected by a stored Cross-Site Scripting (XSS) vulnerability in modules/system/admin.php which may result in arbitrary remote code execution. The vulnerability was discovered and disclosed on June 18, 2020 (GitHub Issue).

The vulnerability exists in the system administration module, specifically in the adsense and customtag functionality. The vulnerable endpoints are '/modules/system/admin.php?fct=adsense&op=mod&adsenseid=4' and '/modules/system/admin.php?fct=customtag&op=mod'. An attacker can inject malicious JavaScript code through the 'ID of the [adsense tag to display this ad]' field and the 'Name' field respectively. The vulnerability has been assigned a CVSS v3.1 Base Score of 4.8 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (NVD).

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of other users' browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions.

The vulnerability requires high privileges to exploit, as the attacker needs access to the administrative interface. A proof-of-concept exploit has been publicly disclosed, demonstrating the injection of JavaScript payload 'alert('AppleBois')' through the vulnerable parameters.