CVE-2025-47289
📋 TL;DR
A stored cross-site scripting (XSS) vulnerability in CE Phoenix eCommerce platform allows attackers to inject malicious JavaScript into testimonial descriptions. When approved by an admin, this script executes in users' browsers, potentially stealing session cookies and leading to account takeover. Affects CE Phoenix versions 1.0.9.9 through 1.1.0.2.
💻 Affected Systems
- CE Phoenix
📦 What is this software?
Ce Phoenix Cart by Phoenixcart
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover of admin and user accounts, data exfiltration, and potential website defacement or malware distribution to visitors.
Likely Case
Session hijacking leading to unauthorized access to user accounts, potential data theft, and privilege escalation.
If Mitigated
Limited impact with proper input validation and output encoding, though still a security concern.
🎯 Exploit Status
Exploitation requires submitting a testimonial (unauthenticated) and waiting for admin approval; public advisory includes technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.0.3
Vendor Advisory: https://github.com/CE-PhoenixCart/PhoenixCart/security/advisories/GHSA-98qq-m8qj-vvgj
Restart Required: No
Instructions:
1. Backup your database and files. 2. Download version 1.1.0.3 from the official repository. 3. Replace affected files with patched versions. 4. Clear any caches. 5. Test functionality.
🔧 Temporary Workarounds
Disable Testimonial Module
allTemporarily disable the testimonial functionality to prevent exploitation.
Navigate to admin panel > Modules > Content > Testimonials > Disable
Implement Input Validation
allAdd server-side validation to sanitize testimonial description input.
Modify testimonial submission handler to strip/escape HTML/JavaScript tags
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with XSS protection rules
- Enable Content Security Policy (CSP) headers to restrict script execution
🔍 How to Verify
Check if Vulnerable:
Check if running CE Phoenix version between 1.0.9.9 and 1.1.0.2 inclusive.Check Version:
Check includes/version.php or admin panel for version numberVerify Fix Applied:
Verify installation of version 1.1.0.3 or later and test testimonial submission with script tags.📡 Detection & Monitoring
Log Indicators:
- Unusual testimonial submissions with script tags or JavaScript code
- Multiple testimonial approvals in short time
Network Indicators:
- Outbound connections to suspicious domains from testimonial pages
- Unexpected JavaScript execution in browser dev tools
SIEM Query:
source="web_logs" AND (uri="/testimonials" OR uri="/admin/testimonials") AND (message="<script" OR message="javascript:")