Listen to this Post
How the mentioned CVE works:
The vulnerability exists in the REDAXO CMS backend’s Mediapool module. When an authenticated backend user accesses the Mediapool view, the application processes the `args
` HTTP GET parameter. This user-supplied input is directly embedded into the HTML output of an information banner without proper sanitization or output encoding. An attacker can craft a malicious URL containing JavaScript payloads within this parameter. If a logged-in administrator or editor is tricked into clicking this link (e.g., via phishing), the payload is rendered and executed in their browser session. This execution occurs within the security context of the backend, allowing the attacker to perform actions as the victim, such as creating new admin accounts, manipulating content, or stealing session cookies. Platform: REDAXO CMS Version: < 5.20.1 Vulnerability: Reflected XSS Severity: Critical date: December 3, 2025 <h2 style="color: blue;">Prediction: Patched (November 2025)</h2> <h2 style="color: blue;">What Undercode Say:</h2> [bash] curl -s "http://target/redaxo/index.php?page=mediapool/media&args[bash]=<script>alert(document.domain)</script>" | grep -oP 'args[types].?(?=<)'
// Vulnerable code snippet concept $info = 'Filter: ' . $_REQUEST['args']['types']; // Unsanitized echo ' <div class="rex-info">' . $info . '</div> ';
How Exploit:
- Attacker crafts malicious URL with JS payload in
args[bash]. - Attacker sends URL to authenticated backend user (phishing).
3. User clicks link while logged in.
4. Payload executes in backend, hijacking session.
Protection from this CVE:
Update to REDAXO 5.20.1. Implement strict input validation and enforce context-aware output encoding (HTML escaping) for all user-controllable data rendered in templates.
Impact:
Backend session hijacking. Full administrative compromise. Unauthorized content/modification.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
