CVE-2020-20589: 
PHP vulnerability analysis and mitigation

Cross Site Scripting (XSS) vulnerability exists in FeehiCMS version 2.0.8, identified as CVE-2020-20589. The vulnerability was discovered and allows remote attackers to execute arbitrary code via the lang attribute of an HTML tag. The issue affects the frontend and backend of the CMS platform (GitHub Issue).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It has been assigned a CVSS v3.1 base score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability can be exploited through the language selection functionality in both the frontend and backend interfaces (NVD).

When successfully exploited, this vulnerability allows attackers to inject and execute arbitrary JavaScript code in the context of other users' browsers. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected user's session (NVD).

The vulnerability is exploitable by sending a crafted request to the language selection endpoint. A proof of concept exists demonstrating exploitation via URLs like 'index.php?r=site/language&lang=english"><alert(/xss/)<' in both frontend and backend interfaces (GitHub Issue).

Users should upgrade to a version newer than FeehiCMS 2.0.8. The vulnerability was reported and documented, though specific patch information is not publicly available (NVD).