Listen to this Post
The CVE-2025-14006 vulnerability exists in dayrui XunRuiCMS versions up to 4.7.1. It is a cross-site scripting (XSS) flaw in the Add Data Validation Page component. Specifically, the issue is in the file /admind45f74adbd95.php with parameters c=field, m=add, rname=site, rid=1, and page=1. The vulnerability arises from improper sanitization of the ‘data[bash]’ input parameter. An attacker can inject malicious JavaScript code into this parameter, which is then executed in the context of the user’s browser when the page is rendered. This allows the attacker to steal session cookies, perform actions on behalf of the user, or deface the website. The attack is remote and requires low privileges, as indicated by the CVSS vector. The exploit has been publicly disclosed, making it accessible to malicious actors. The vendor was contacted but did not respond, indicating no patch is available at the time of disclosure.
Platform: dayrui XunRuiCMS
Version: Up to 4.7.1
Vulnerability: Cross-Site Scripting
Severity: Medium
date: 2025-12-04
Prediction: Patch date unknown
What Undercode Say:
Analytics:
!/bin/bash
Test for CVE-2025-14006
curl -s “http://target/admind45f74adbd95.php?c=field&m=add&rname=site&rid=1&page=1” –data-urlencode “data[bash]=”
Check response for XSS
grep -q “script” response.html && echo “Vulnerable”
How Exploit:
Inject script via data[bash].
Remote execution triggered.
Steal cookies/sessions.
Protection from this CVE
Input sanitization required.
Implement CSP headers.
Upgrade if patch available.
Impact:
Session hijacking possible.
Unauthorized actions allowed.
Website defacement risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
