CVE-2025-10330
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts via the search parameter (q) in cdevroe unmark's search form, leading to cross-site scripting (XSS). It affects all users of unmark up to version 1.9.3 who have the vulnerable file accessible. Remote exploitation is possible without authentication.
💻 Affected Systems
- cdevroe unmark
📦 What is this software?
Unmark by Unmark
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, or perform actions on behalf of authenticated users if the XSS payload is executed in an authenticated context.
Likely Case
Attackers inject malicious JavaScript that runs in victims' browsers, potentially stealing session tokens or displaying phishing content.
If Mitigated
With proper input validation and output encoding, the XSS payload would be neutralized before execution.
🎯 Exploit Status
Proof of concept is publicly available. Remote exploitation is possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider applying manual fixes or workarounds.
🔧 Temporary Workarounds
Input Validation and Output Encoding
allManually sanitize the 'q' parameter in searchform.php to prevent XSS payloads from executing.
Edit application/views/layouts/topbar/searchform.php and apply proper HTML encoding to the q parameter output
WAF Rule Implementation
allDeploy web application firewall rules to block XSS patterns in search parameters.
Configure WAF to filter malicious scripts in query parameters
🧯 If You Can't Patch
- Restrict access to the vulnerable search form to trusted users only
- Implement Content Security Policy (CSP) headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check if your unmark version is 1.9.3 or earlier and if the searchform.php file exists without proper input sanitization.Check Version:
Check the unmark version in your installation directory or configuration filesVerify Fix Applied:
Test the search functionality with XSS payloads (e.g., <script>alert('test')</script>) to ensure they are properly encoded or blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual search queries containing script tags or JavaScript code
- Multiple failed search attempts with malicious patterns
Network Indicators:
- HTTP requests with suspicious parameters in search queries
- Unexpected JavaScript execution from search results
SIEM Query:
search query="*<script>*" OR query="*javascript:*" AND uri="*search*"🔗 References
- https://github.com/YZS17/CVE/blob/main/unmark/xss1.md
- https://github.com/YZS17/CVE/blob/main/unmark/xss1.md#poc
- https://vuldb.com/?ctiid.323756
- https://vuldb.com/?id.323756
- https://vuldb.com/?submit.643532
- https://github.com/YZS17/CVE/blob/main/unmark/xss1.md
- https://github.com/YZS17/CVE/blob/main/unmark/xss1.md#poc
