CVE-2020-25915: 
PHP vulnerability analysis and mitigation

Cross Site Scripting (XSS) vulnerability exists in UserController.php in ThinkCMF version 5.1.5, which allows attackers to execute arbitrary code via crafted user_login parameter. The vulnerability was discovered and reported on September 17, 2020 (GitHub Issue).

The vulnerability exists in the admin controller (vendor/thinkcmf/cmf-app/src/admin/controller/UserController.php) where there is insufficient filtering of user POST requests. Specifically, the code directly inserts or updates POST data into the database without proper sanitization at line 138 ($result = DB::name('user')->insertGetId($_POST)) and line 221 ($result = DB::name('user')->update($_POST)). The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows attackers to store and execute malicious JavaScript code in the user management section. When other users view the affected pages, the stored malicious code executes in their browsers, potentially leading to session hijacking, credential theft, or other client-side attacks (GitHub Issue).