CVE-2025-30006
📋 TL;DR
Xorcom CompletePBX administrative control panel contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts via crafted URLs. This affects all administrators who access the vulnerable control panel interface. The vulnerability exists in all versions up to and including 5.2.35.
💻 Affected Systems
- Xorcom CompletePBX
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Administrator account compromise leading to full system takeover, data exfiltration, or deployment of backdoors.
Likely Case
Session hijacking, credential theft, or unauthorized administrative actions performed by tricking administrators into clicking malicious links.
If Mitigated
Limited impact if administrators use separate browser profiles, have clickjacking protection, or avoid clicking untrusted links.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated administrators into clicking malicious URLs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.2.36.1
Vendor Advisory: https://www.xorcom.com/new-completepbx-release-5-2-36-1/
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download CompletePBX 5.2.36.1 from Xorcom. 3. Follow vendor upgrade instructions. 4. Restart the PBX system. 5. Verify the administrative interface functions correctly.
🔧 Temporary Workarounds
Input Validation via Web Application Firewall
allDeploy a WAF with XSS protection rules to filter malicious input before it reaches the application.
Content Security Policy Headers
linuxImplement CSP headers to restrict script execution sources and mitigate XSS impact.
Add 'Content-Security-Policy: default-src 'self'; script-src 'self'' to web server configuration
🧯 If You Can't Patch
- Restrict administrative access to trusted IP addresses only using firewall rules.
- Educate administrators to never click untrusted links while logged into the control panel.
🔍 How to Verify
Check if Vulnerable:
Check if CompletePBX version is 5.2.35 or earlier via the administrative interface or system logs.Check Version:
ssh admin@pbx-host 'cat /etc/completepbx/version' or check web interface footerVerify Fix Applied:
Confirm the system reports version 5.2.36.1 or later in the administrative interface.📡 Detection & Monitoring
Log Indicators:
- Unusual long URLs with script tags in web access logs
- Multiple failed login attempts followed by suspicious redirects
Network Indicators:
- HTTP requests containing script tags or JavaScript code in query parameters
- Unusual outbound connections from PBX administrative interface
SIEM Query:
source="web_access.log" AND (url="*<script*" OR url="*javascript:*")