Listen to this Post
How CVE-2025-47048 Works
Adobe Experience Manager (AEM) versions 6.5.22 and earlier fail to properly sanitize user-supplied input in certain form fields. A low-privileged attacker can inject malicious JavaScript payloads into these fields, which are then stored in the system. When other users access pages containing the compromised field, the script executes in their browser session, potentially leading to session hijacking, data theft, or unauthorized actions within the application. The vulnerability arises due to insufficient input validation in the WCM (Web Content Management) component.
DailyCVE Form
Platform: Adobe Experience Manager
Version: ≤ 6.5.22
Vulnerability: Stored XSS
Severity: Critical
Date: 06/16/2025
Prediction: Patch by 07/15/2025
What Undercode Say
Check vulnerable version curl -I http://target/aem/version Exploit PoC (sanitized) POST /content/forms/af/injectablefield.html HTTP/1.1 Payload: <script>alert(document.cookie)</script>
How Exploit
1. Attacker authenticates with low privileges.
2. Submits malicious script via vulnerable form.
3. Admin views compromised page, triggering execution.
Protection from this CVE
1. Upgrade to AEM 6.5.23+.
2. Implement CSP headers.
3. Sanitize all form inputs.
Impact
1. Session hijacking.
2. Data exfiltration.
3. Privilege escalation.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
