CVE-2025-15451
📋 TL;DR
This CVE describes a cross-site scripting (XSS) vulnerability in xnx3 wangmarket CMS versions up to 4.9. Attackers can inject malicious scripts via the Description parameter on the system variables page, potentially compromising user sessions or stealing credentials. The vulnerability affects administrators who access the vulnerable /admin/system/variableSave.do endpoint.
💻 Affected Systems
- xnx3 wangmarket
📦 What is this software?
Wangmarket by Wang.market
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, gain full administrative access to the CMS, deface websites, or install backdoors for persistent access.
Likely Case
Attackers would typically use this to hijack administrator sessions, modify website content, or redirect users to malicious sites.
If Mitigated
With proper input validation and output encoding, the attack would be prevented, limiting impact to failed exploitation attempts.
🎯 Exploit Status
Exploit requires administrator access to the vulnerable endpoint. Public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a version above 4.9 if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize the Description parameter before processing.
Modify /admin/system/variableSave.do to include HTML entity encoding for user inputs
Web Application Firewall (WAF)
allDeploy a WAF with XSS protection rules to block malicious payloads.
Configure WAF to block requests containing <script> tags or JavaScript in Description parameter
🧯 If You Can't Patch
- Restrict access to /admin/system/variableSave.do endpoint using network ACLs or authentication requirements
- Implement Content Security Policy (CSP) headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check if your xnx3 wangmarket version is 4.9 or earlier by examining version files or admin panel.Check Version:
Check version.txt file or admin dashboard for version informationVerify Fix Applied:
Test the Description parameter with XSS payloads like <script>alert('test')</script> to ensure it's properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /admin/system/variableSave.do with script tags in parameters
- Multiple failed login attempts followed by successful admin access
Network Indicators:
- HTTP requests containing <script> tags in POST data to the vulnerable endpoint
SIEM Query:
source="web_logs" AND uri_path="/admin/system/variableSave.do" AND (request_body CONTAINS "<script>" OR request_body CONTAINS "javascript:")