GHSA-m8v7-x398-pxrf: 
PHP vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was identified in SilverStripe CMS Edit Page, tracked as SS-2016-004. The vulnerability was discovered in early 2016 and affected versions 3.1.18, 3.2.3, and 3.3.1 of the SilverStripe framework. The issue was fixed with the release of versions 3.1.19, 3.2.4, and 3.3.2 on May 11, 2016. The vulnerability was rated as Moderate severity with a CVSS score of 6.1 (GitHub Advisory).

The vulnerability stemmed from insufficient parameter sanitization in the CMS Edit page functionality. The issue was specifically related to how page IDs were handled, which required a fix to ensure they were properly stored as integers. The vulnerability has a CVSS v3.1 base metrics configuration of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating it was exploitable over the network with low attack complexity, required no privileges but needed user interaction, and could affect resources beyond the security scope of the vulnerable component (GitHub Advisory).

The vulnerability allowed attackers to inject arbitrary HTML into the CMS Edit page through carefully crafted URLs. This could potentially lead to the execution of malicious scripts in the context of the site administrator's session, compromising the integrity and confidentiality of the CMS (Silverstripe Security).

The vulnerability required an attacker to create a specially crafted URL and convince a site administrator to click on it. The attack vector was network-based but required user interaction to be successful. The vulnerability was classified with low attack complexity, indicating it was relatively straightforward to exploit once the conditions were met (GitHub Advisory).

The vulnerability was patched by implementing proper integer type casting for page IDs. Users were advised to upgrade to the fixed versions: 3.1.19, 3.2.4, or 3.3.2, depending on their installation version. The fix was implemented through a commit that modified the storage of current page IDs to ensure they were properly cast as integers (Framework Commit).