CVE-2025-25908
📋 TL;DR
A stored cross-site scripting (XSS) vulnerability in tianti v2.3 allows attackers to inject malicious scripts into the coverImageURL parameter when saving articles. This affects all users of tianti v2.3 who can access the article saving functionality, potentially compromising user sessions and data.
💻 Affected Systems
- tianti
📦 What is this software?
Tianti by Tianti Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal admin credentials, deface the website, redirect users to malicious sites, or perform actions on behalf of authenticated users.
Likely Case
Session hijacking, cookie theft, and unauthorized actions performed by authenticated users who view the malicious article.
If Mitigated
Limited impact with proper input validation and output encoding, potentially only affecting users who directly interact with the malicious content.
🎯 Exploit Status
Exploitation requires ability to save articles (typically authenticated access). The GitHub issue shows proof of concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: unknown
Vendor Advisory: https://github.com/xujeff/tianti/issues/40
Restart Required: No
Instructions:
No official patch available. Implement input validation and output encoding as workaround.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation to reject or sanitize malicious input in coverImageURL parameter
Content Security Policy
allImplement CSP headers to restrict script execution sources
🧯 If You Can't Patch
- Disable article saving functionality if not required
- Implement WAF rules to block XSS payloads in coverImageURL parameter
🔍 How to Verify
Check if Vulnerable:
Test by attempting to save an article with JavaScript payload in coverImageURL field and check if it executes when viewing the article.Check Version:
Check tianti version in configuration files or admin panelVerify Fix Applied:
Test the same payload after implementing fixes to confirm it's properly sanitized or blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual coverImageURL values containing script tags or JavaScript in article save requests
- Multiple failed article save attempts with suspicious payloads
Network Indicators:
- HTTP POST requests to /article/ajax/save with script content in parameters
SIEM Query:
source="web_logs" AND uri="/article/ajax/save" AND (param="coverImageURL" CONTAINS "<script>" OR param="coverImageURL" CONTAINS "javascript:")