CVE-2025-71164
📋 TL;DR
Typesetter CMS versions up to 5.1 contain a reflected XSS vulnerability in the Editing component where the images parameter is improperly sanitized. An authenticated attacker with editing privileges can inject malicious JavaScript that executes in victims' browsers. This affects all Typesetter CMS installations running vulnerable versions.
💻 Affected Systems
- Typesetter CMS
📦 What is this software?
Typesetter by Typesettercms
⚠️ Risk & Real-World Impact
Worst Case
An attacker could steal admin session cookies, perform actions as authenticated users, deface websites, or redirect users to malicious sites.
Likely Case
Attackers with editing privileges could target other administrators to escalate privileges or maintain persistence in the CMS.
If Mitigated
With proper input validation and output encoding, the vulnerability would be neutralized with no impact.
🎯 Exploit Status
Exploitation requires authenticated access with editing privileges; reflected XSS via POST request to include/tool/Editing.php.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 5.1 (check GitHub for latest)
Vendor Advisory: https://github.com/Typesetter/Typesetter/issues/706
Restart Required: No
Instructions:
1. Update Typesetter CMS to latest version from GitHub. 2. Replace include/tool/Editing.php with patched version. 3. Clear any cached files.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to reject javascript: protocol in images parameter
Modify include/tool/Editing.php to sanitize $_POST['images'] array elements
🧯 If You Can't Patch
- Restrict editing privileges to trusted users only
- Implement Content Security Policy (CSP) with script-src directives to block inline JavaScript
🔍 How to Verify
Check if Vulnerable:
Review include/tool/Editing.php for improper href attribute output encoding of images parameterCheck Version:
Check version in admin panel or read CHANGELOG.txtVerify Fix Applied:
Check that images parameter values are properly encoded in href attributes📡 Detection & Monitoring
Log Indicators:
- POST requests to include/tool/Editing.php with javascript: in parameters
Network Indicators:
- HTTP POST to Editing.php with suspicious images[] parameter values
SIEM Query:
web_uri="/include/tool/Editing.php" AND http_method=POST AND (param CONTAINS "javascript:")