CVE-2025-5013
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into the search functionality of HkCms. When users view search results containing the manipulated keyword parameter, their browsers execute the attacker's code. All HkCms installations up to version 2.3.2.240702 with the search feature enabled are affected.
💻 Affected Systems
- HkCms
📦 What is this software?
Hkcms by Hkcms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, or perform actions on behalf of authenticated users if combined with other vulnerabilities.
Likely Case
Attackers inject malicious scripts that steal user session data or display phishing content to users viewing search results.
If Mitigated
With proper input validation and output encoding, the malicious scripts would be rendered harmless as text rather than executed.
🎯 Exploit Status
The exploit has been publicly disclosed and requires minimal technical skill to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://gitee.com/Hk_Cms/HkCms/issues/IBZ2G7
Restart Required: No
Instructions:
Check the vendor repository for updates. If a patch is released, update HkCms to the latest version following standard CMS update procedures.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize the 'keyword' parameter before processing.
Modify /index.php/search/index.html to validate and sanitize user input
Output Encoding
allApply proper output encoding when displaying search results to prevent script execution.
Implement HTML entity encoding for all user-controlled output in search results
🧯 If You Can't Patch
- Disable the search functionality if not essential
- Implement a web application firewall (WAF) with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Test by submitting a search with a payload like <script>alert('XSS')</script> in the keyword parameter and check if it executes.Check Version:
Check the CMS version in the admin panel or configuration filesVerify Fix Applied:
After implementing fixes, repeat the test payload to confirm scripts are no longer executed.📡 Detection & Monitoring
Log Indicators:
- Unusual search queries containing script tags or JavaScript code
- Multiple failed search attempts with malicious patterns
Network Indicators:
- HTTP requests to /index.php/search/index.html with suspicious parameters
SIEM Query:
source="web_server" AND uri_path="/index.php/search/index.html" AND (query_string CONTAINS "<script>" OR query_string CONTAINS "javascript:")