CVE-2025-3397
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts via the 'gourl' parameter in YzmCMS 7.1's message.tpl file, leading to cross-site scripting (XSS). Attackers can execute arbitrary JavaScript in victims' browsers when they view manipulated content. All users running YzmCMS 7.1 with the vulnerable message.tpl file are affected.
💻 Affected Systems
- YzmCMS
📦 What is this software?
Yzmcms by Yzmcms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, perform actions on behalf of authenticated users, or deliver malware through the compromised web application.
Likely Case
Attackers will typically use this to steal session cookies or credentials, perform phishing attacks, or deface websites by injecting malicious content.
If Mitigated
With proper input validation and output encoding, the malicious scripts would be neutralized, preventing execution in users' browsers.
🎯 Exploit Status
The exploit has been publicly disclosed and requires minimal technical skill to execute. Attackers can launch this remotely without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch is available as the vendor has not responded. Monitor the YzmCMS website or repository for updates.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation and sanitization of the 'gourl' parameter to remove or encode malicious characters.
Content Security Policy (CSP)
allImplement a strict CSP header to prevent execution of inline scripts and restrict script sources to trusted domains only.
🧯 If You Can't Patch
- Implement a Web Application Firewall (WAF) with XSS protection rules to block malicious requests.
- Disable or restrict access to the vulnerable message.tpl functionality if not essential.
🔍 How to Verify
Check if Vulnerable:
Test by injecting a simple script payload into the 'gourl' parameter and checking if it executes in the browser.Check Version:
Check the YzmCMS version in the admin panel or configuration files.Verify Fix Applied:
After applying workarounds, test with the same payload to ensure it is properly sanitized or blocked.📡 Detection & Monitoring
Log Indicators:
- Log entries showing suspicious 'gourl' parameter values containing script tags or JavaScript code.
Network Indicators:
- HTTP requests with 'gourl' parameter containing script tags or encoded JavaScript.
SIEM Query:
http.uri_query contains 'gourl' AND (http.uri_query contains '<script' OR http.uri_query contains 'javascript:')