Listen to this Post
CVE-2025-60646 is a stored cross-site scripting vulnerability in the Business Line Management module of Xxl-api version 1.3.0. The flaw allows attackers to inject malicious web scripts or HTML into the Name parameter, which is persistently stored in the application database. This input lacks proper sanitization and output encoding, enabling the injection of arbitrary JavaScript payloads. When authenticated users, such as administrators, access the Business Line Management interface, the stored payload is rendered and executed in their browser context. Attackers can craft payloads like to steal session cookies or perform actions on behalf of users. The vulnerability arises from trusting user-controlled data without validation before storage and display. As the script is server-side stored, it requires no direct victim interaction, amplifying risk. Exploitation could lead to account takeover, data exfiltration, or redirection to malicious sites. The Business Line Management module is typically accessed after authentication, making it vulnerable to insider threats or compromised credentials. The persistent nature of stored XSS often results in a higher CVSS score, affecting confidentiality and integrity. Mitigation involves implementing strict input validation, output encoding for HTML contexts, and Content Security Policy headers. Developers should audit all user inputs, especially in management modules, and employ secure coding practices. Regular penetration testing and code reviews can help identify such vulnerabilities before production deployment.
Platform: Xxl-api
Version: v1.3.0
Vulnerability: Stored XSS
Severity: Medium
Date: 11/12/2025
Prediction: Expected by 12/2025
What Undercode Say:
Analytics:
curl -v http://target/xxl-api/business-line
grep -r “Name parameter” source/
python3 xsstrike.py -u target_url
How Exploit:
Inject malicious script into Name parameter via Business Line Management interface. Payload stored in database. Script executes when users view affected module, stealing sessions or redirecting.
Protection from this CVE:
Input validation and sanitization. Output encoding for HTML. Content Security Policy (CSP). Regular security patches.
Impact:
Session hijacking. Data theft. Unauthorized actions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
