CVE-2025-15094
📋 TL;DR
This CVE describes a reflected cross-site scripting (XSS) vulnerability in sunkaifei FlyCMS's user login function. Attackers can inject malicious scripts via the redirectUrl parameter, potentially stealing user credentials or session cookies. Any FlyCMS deployment using the vulnerable code is affected.
💻 Affected Systems
- sunkaifei FlyCMS
📦 What is this software?
Flycms by Sunkaifei
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator credentials, gain full control of the CMS, deface websites, or install backdoors.
Likely Case
Attackers steal user session cookies to hijack accounts, perform actions as authenticated users, or redirect to phishing sites.
If Mitigated
With proper input validation and output encoding, the attack fails silently with no impact.
🎯 Exploit Status
Exploit details are publicly available in GitHub issue #16, requiring only crafted URLs with malicious redirectUrl parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None
Restart Required: No
Instructions:
No official patch exists. The project has not responded to the issue report. Consider applying community fixes or workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize redirectUrl parameter by allowing only safe URLs.
Modify src/main/java/com/flycms/web/front/UserController.java to validate redirectUrl against a whitelist of allowed domains or paths.
Output Encoding
allApply proper HTML encoding to the redirectUrl parameter before rendering in responses.
Update the affected function to encode redirectUrl using libraries like OWASP Java Encoder before output.
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with XSS protection rules to block malicious redirectUrl payloads.
- Disable or restrict the redirectUrl functionality if not essential for user login flows.
🔍 How to Verify
Check if Vulnerable:
Test by accessing the login endpoint with a redirectUrl parameter containing a simple XSS payload like <script>alert(1)</script> and check if it executes.Check Version:
Check the Git commit hash of the FlyCMS installation; if it is abbaa5a8daefb146ad4d61027035026b052cb414 or earlier, it is vulnerable.Verify Fix Applied:
After applying fixes, retest with the same XSS payload to ensure it is properly sanitized or encoded and does not execute.📡 Detection & Monitoring
Log Indicators:
- Log entries showing redirectUrl parameters with script tags or JavaScript code in user login requests.
Network Indicators:
- HTTP requests to login endpoints containing suspicious redirectUrl values with encoded payloads.
SIEM Query:
source="web_logs" AND uri_path="/user/login" AND query_string="*redirectUrl=*<script>*"