SoyCMS 3.0.2 and earlier is affected by Reflected Cross-Site Scripting (XSS) which leads to Remote Code Execution (RCE) from a known vulnerability. This allows remote attackers to force the administrator to edit files once the adminsitrator loads a specially crafted webpage.

Impact: XSS to RCE via Inquiry Error and Content modification

• Attack vector is: Administrator must be logged in.
• Components are: CMSApplication.class.php
• Tested SoyCMS Version : 3.0.2 (latest)
• Affected SoyCMS Version : ~3.0.2

Found by @stypr from Vulnerability Research Team in Flatt Security Inc.

Reference:
Issue: #8
Fix PR: #13
https://youtu.be/uAMAwH35ups