CVE-2025-64048
📋 TL;DR
YCCMS 3.4 contains a stored XSS vulnerability in article management that allows attackers to inject malicious scripts into article titles. When other users view articles with these titles, the scripts execute in their browsers. This affects all YCCMS 3.4 installations with article management functionality.
💻 Affected Systems
- YCCMS
📦 What is this software?
Yccms by Yccms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, take over admin accounts, deface websites, or redirect users to malicious sites, potentially leading to complete system compromise.
Likely Case
Attackers inject malicious scripts that steal user session cookies or credentials when users view articles, leading to account takeover and unauthorized access.
If Mitigated
With proper input validation and output encoding, malicious scripts are neutralized before execution, preventing successful exploitation.
🎯 Exploit Status
Exploitation requires access to article management functionality, typically requiring at least contributor-level permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://yccms.com
Restart Required: No
Instructions:
1. Check vendor website for security updates
2. Apply any available patches
3. Verify fix by testing article title input validation
🔧 Temporary Workarounds
Input Validation and Output Encoding
allImplement proper input validation on article title field and encode output before displaying
Modify ArticleAction.class.php to sanitize user input in add() and getPost() functions
🧯 If You Can't Patch
- Disable article management functionality if not required
- Implement web application firewall (WAF) rules to block XSS payloads
🔍 How to Verify
Check if Vulnerable:
Test by entering XSS payload in article title field (e.g., <script>alert('XSS')</script>) and check if it executes when viewing articlesCheck Version:
Check YCCMS version in admin panel or configuration filesVerify Fix Applied:
Test with same XSS payloads and verify they are properly sanitized and don't execute📡 Detection & Monitoring
Log Indicators:
- Unusual article creation/modification patterns
- Suspicious characters in article titles
Network Indicators:
- Requests containing XSS payloads in POST parameters
SIEM Query:
search 'article' AND ('<script>' OR 'javascript:' OR 'onload=' OR 'onerror=')