Listen to this Post
How the CVE Works
The vulnerability exists in the Image plugin of Apache JSPWiki, where improper input sanitization allows an attacker to inject malicious JavaScript via a crafted request. When a victim views a page containing the manipulated image tag, the script executes in their browser, potentially stealing session cookies, redirecting to malicious sites, or performing actions on behalf of the user. The exploit leverages insufficient escaping in the plugin’s rendering logic, enabling payload delivery through attributes like `onerror` or src.
DailyCVE Form
Platform: Apache JSPWiki
Version: < 2.12.3
Vulnerability: Stored XSS
Severity: Moderate
Date: Jul 31, 2025
Prediction: Patch expected by Aug 15, 2025
What Undercode Say
Check JSPWiki version curl -I http://target/wiki/Version.jsp Exploit PoC (sanitized) <img src=x onerror=alert(document.cookie)>
How Exploit
1. Attacker crafts malicious image markup.
2. Submits to JSPWiki via upload/form.
3. Victim loads page, script executes.
Protection from this CVE
- Upgrade to JSPWiki 2.12.3+.
- Sanitize user-supplied image attributes.
- Implement CSP headers.
Impact
- Session hijacking.
- Unauthorized actions.
- Data exfiltration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
