CVE-2025-8221
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts via the 'keyword' parameter in the goodsSearch function of JPACookieShop. When exploited, it enables reflected cross-site scripting attacks that can steal user sessions or redirect to malicious sites. All users of JPACookieShop up to commit 24a15c02b4f75042c9f7f615a3fed2ec1cefb999 are affected.
💻 Affected Systems
- jerryshensjf JPACookieShop 蛋糕商城JPA版
📦 What is this software?
Jpacookieshop by Jerryshensjf
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator credentials, take over the e-commerce platform, and compromise customer payment information.
Likely Case
Attackers steal user session cookies to impersonate customers and make unauthorized purchases.
If Mitigated
Script execution is blocked by Content Security Policy, limiting impact to minor UI disruption.
🎯 Exploit Status
Exploit details are publicly available in GitHub repositories. The vulnerability requires no authentication and is trivial to exploit with basic web testing tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
Update to a version after commit 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Since this is a rolling release product, pull the latest code from the repository and rebuild.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize the 'keyword' parameter by removing HTML tags and JavaScript content
// In GoodsCustController.java, add: keyword = keyword.replaceAll("<[^>]*>", "").replaceAll("\\s*[\\"'`]\\s*", "")
Content Security Policy Header
allImplement CSP headers to prevent script execution from untrusted sources
// Add to web configuration: response.setHeader("Content-Security-Policy", "default-src 'self'; script-src 'self'")
🧯 If You Can't Patch
- Implement a Web Application Firewall (WAF) with XSS protection rules to filter malicious keyword parameters
- Disable the goodsSearch functionality temporarily if not business-critical
🔍 How to Verify
Check if Vulnerable:
Test by accessing /goods/search?keyword=<script>alert('XSS')</script> and checking if script executesCheck Version:
git log --oneline -1Verify Fix Applied:
After patching, test the same payload and verify no script execution occurs📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing script tags in keyword parameter
- Unusual search patterns with HTML/JavaScript content
Network Indicators:
- HTTP GET requests with encoded script payloads in query parameters
- Multiple rapid requests to goodsSearch endpoint
SIEM Query:
source="web_logs" AND uri_path="/goods/search" AND query_string="*<script>*"🔗 References
- https://github.com/Bemcliu/cve-reports/blob/main/cve-04-%E8%9B%8B%E7%B3%95%E5%95%86%E5%9F%8EJPA%E7%89%88-Reflected%20XSS/readme.md
- https://vuldb.com/?ctiid.317809
- https://vuldb.com/?id.317809
- https://vuldb.com/?submit.621784
- https://github.com/Bemcliu/cve-reports/blob/main/cve-04-%E8%9B%8B%E7%B3%95%E5%95%86%E5%9F%8EJPA%E7%89%88-Reflected%20XSS/readme.md
