CVE-2025-1742
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts via the 'page_name' parameter in PiHome's /home.php file, leading to cross-site scripting (XSS). It affects PiHome 2.0 installations, potentially compromising user sessions and data. The vulnerability can be exploited remotely without authentication.
💻 Affected Systems
- pihome-shc PiHome
📦 What is this software?
Maxair by Pihome
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, or perform actions on behalf of authenticated users, potentially leading to full account compromise.
Likely Case
Attackers inject malicious scripts that steal session tokens or credentials from users who visit the vulnerable page, leading to unauthorized access.
If Mitigated
With proper input validation and output encoding, the XSS payloads would be neutralized, preventing script execution.
🎯 Exploit Status
Public proof-of-concept exists on GitHub. Exploitation requires minimal technical skill as it involves simple parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor has not responded to disclosure. Consider implementing workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Input Validation Filter
linuxImplement server-side input validation to sanitize the page_name parameter, rejecting or encoding special characters.
Modify /home.php to add: $page_name = htmlspecialchars($_GET['page_name'], ENT_QUOTES, 'UTF-8');
Web Application Firewall (WAF)
allDeploy a WAF with XSS protection rules to block malicious requests targeting the page_name parameter.
🧯 If You Can't Patch
- Isolate PiHome instance behind a reverse proxy with strict input filtering.
- Disable or restrict access to the /home.php endpoint if not essential.
🔍 How to Verify
Check if Vulnerable:
Test by accessing /home.php?page_name=<script>alert('XSS')</script> and checking if script executes in browser.Check Version:
Check PiHome version in web interface or configuration files; typically shown in admin panel or footer.Verify Fix Applied:
After applying workarounds, retest with the same payload; script should not execute and input should be properly encoded.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /home.php with suspicious parameters containing script tags or JavaScript code in page_name.
Network Indicators:
- Unusual traffic patterns to /home.php endpoint with encoded or obfuscated payloads.
SIEM Query:
source="web_logs" AND uri_path="/home.php" AND query_string="*page_name=*script*"