CVE-2025-15144
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in XunRuiCMS that allows attackers to inject malicious scripts via the JSONP callback parameter. The vulnerability affects XunRuiCMS versions up to 4.7.1 and can be exploited remotely without authentication. Attackers could steal session cookies, redirect users, or perform actions on behalf of authenticated users.
💻 Affected Systems
- dayrui XunRuiCMS
📦 What is this software?
Xunruicms by Xunruicms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, gain administrative access to the CMS, deface websites, or install backdoors for persistent access.
Likely Case
Attackers would steal user session cookies to hijack accounts, redirect users to malicious sites, or perform limited actions based on the victim's permissions.
If Mitigated
With proper input validation and output encoding, the attack would be prevented, though the vulnerable code path would still exist.
🎯 Exploit Status
Public exploit details are available in the references. The vulnerability requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch is available. The vendor did not respond to disclosure. Consider upgrading if a newer version becomes available or implement workarounds.
🔧 Temporary Workarounds
Input Validation for JSONP Callback
allAdd validation to ensure the callback parameter contains only alphanumeric characters and underscores
Modify /dayrui/Fcms/Init.php to validate the callback parameter before processing
Content Security Policy Header
allImplement CSP headers to restrict script execution sources
Add 'Content-Security-Policy: script-src 'self'' to HTTP responses
🧯 If You Can't Patch
- Implement a Web Application Firewall (WAF) with XSS protection rules
- Disable JSONP functionality if not required for the application
🔍 How to Verify
Check if Vulnerable:
Check if XunRuiCMS version is 4.7.1 or earlier. Test by attempting to inject script payloads in the JSONP callback parameter.Check Version:
Check the CMS version in the admin panel or look for version information in source filesVerify Fix Applied:
Verify that script injection attempts in the JSONP callback parameter are properly sanitized or rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual callback parameter values in JSONP requests
- Script tags or JavaScript code in callback parameters
Network Indicators:
- HTTP requests with suspicious callback parameter values containing script tags or JavaScript
SIEM Query:
web_requests callback:*script* OR callback:*javascript*