CVE-2025-15416
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into the 'Remark' or 'Variable Value' parameters of the Add Global Variable Handler in xnx3 wangmarket. The stored cross-site scripting (XSS) can be executed remotely, potentially affecting users who access the compromised pages. Systems running wangmarket up to version 6.4 are vulnerable.
💻 Affected Systems
- xnx3 wangmarket
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, perform actions on behalf of authenticated users, or deface the website.
Likely Case
Attackers inject malicious scripts that execute in users' browsers, potentially stealing session tokens or performing limited unauthorized actions.
If Mitigated
With proper input validation and output encoding, the malicious scripts would be rendered harmless as text rather than executable code.
🎯 Exploit Status
Exploit details are publicly available on GitHub, and the vulnerability requires authentication to access the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a version above 6.4 if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation and sanitization of 'Remark' and 'Variable Value' parameters to strip or encode HTML/JavaScript content.
Content Security Policy (CSP)
allImplement a strict Content Security Policy header to prevent execution of inline scripts and unauthorized script sources.
🧯 If You Can't Patch
- Restrict access to the /siteVar/save.do endpoint using network controls or web application firewalls (WAF).
- Implement output encoding in the application to ensure user input is treated as text rather than executable code.
🔍 How to Verify
Check if Vulnerable:
Check if your wangmarket version is 6.4 or earlier and if the /siteVar/save.do endpoint accepts unsanitized input in Remark/Variable Value parameters.Check Version:
Check the application's version in its admin panel or configuration files.Verify Fix Applied:
Test the vulnerable endpoint with XSS payloads to ensure they are properly sanitized or blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /siteVar/save.do with script tags or JavaScript in parameters
- Multiple failed attempts to access the endpoint
Network Indicators:
- HTTP requests containing <script> tags or JavaScript functions in POST data to the vulnerable endpoint
SIEM Query:
source="web_server" AND (url="/siteVar/save.do" AND (post_data CONTAINS "<script>" OR post_data CONTAINS "javascript:"))