CVE-2019-25280: Yahei-PHP Prober XSS Vulnerability

CVE-2019-25280 Overview

CVE-2019-25280 is a remote HTML injection vulnerability affecting Yahei-PHP Prober version 0.4.7. This flaw allows attackers to execute arbitrary HTML code through the speed GET parameter in prober.php, enabling cross-site scripting (XSS) attacks in user browser sessions. The vulnerability stems from improper input validation, allowing malicious HTML content to be injected and rendered in the context of legitimate user sessions.

Critical Impact

Attackers can inject malicious HTML/JavaScript code via the speed parameter to hijack user sessions, steal credentials, or perform actions on behalf of authenticated users.

Affected Products

• Yahei-PHP Prober 0.4.7

Discovery Timeline

• 2026-01-08 - CVE CVE-2019-25280 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2019-25280

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The attack can be executed remotely over the network without requiring authentication, though it does require user interaction to trigger the malicious payload. The vulnerability allows attackers to compromise the integrity of user sessions through injected content that executes in the victim's browser context.

Root Cause

The root cause of CVE-2019-25280 lies in the lack of proper input sanitization for the speed GET parameter in prober.php. The application fails to properly encode or filter user-supplied input before reflecting it in the HTML response, allowing attackers to inject arbitrary HTML and JavaScript code that gets executed in the browser of anyone viewing the affected page.

Attack Vector

The attack is network-based (AV:N) and requires low complexity to execute. An attacker constructs a malicious URL containing HTML or JavaScript code in the speed parameter and tricks a victim into clicking the link. When the victim accesses the crafted URL, the injected code executes in their browser session. This can be leveraged to steal session cookies, redirect users to phishing sites, deface the page, or perform other malicious actions within the security context of the vulnerable application.

The vulnerability is exploited by appending malicious HTML content to the speed parameter in requests to prober.php. For example, an attacker could inject script tags or event handlers that execute JavaScript when the page is rendered. For detailed technical analysis and proof-of-concept information, see the Zero Science Vulnerability ZSL-2019-5531 advisory.

Detection Methods for CVE-2019-25280

Indicators of Compromise

• HTTP requests to prober.php containing HTML tags or JavaScript in the speed parameter
• Unusual URL patterns with encoded script tags such as %3Cscript%3E in GET parameters
• Web server logs showing requests with suspicious payloads targeting the speed parameter
• User reports of unexpected pop-ups or redirects when accessing the PHP Prober interface

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XSS payloads in GET parameters
• Monitor web server access logs for requests containing HTML special characters in the speed parameter
• Deploy browser-based XSS protection headers such as Content-Security-Policy to mitigate impact
• Use intrusion detection systems (IDS) signatures to identify HTML injection attempts

Monitoring Recommendations

• Enable verbose logging for prober.php to capture all parameter values in requests
• Set up alerts for web requests containing common XSS indicators like <script>, onerror=, or javascript:
• Monitor for unusual referrer patterns that may indicate users being redirected from malicious links

How to Mitigate CVE-2019-25280

Immediate Actions Required

• Restrict access to prober.php to trusted IP addresses or authenticated administrators only
• Remove or disable Yahei-PHP Prober if it is not actively needed in production environments
• Implement Content-Security-Policy headers to prevent inline script execution
• Apply input validation to sanitize the speed parameter before output

Patch Information

No official vendor patch is currently available for Yahei-PHP Prober 0.4.7. The vendor website appears to be inactive based on archived resources. Organizations are advised to consider alternative server monitoring tools that are actively maintained. For additional technical details, refer to the CXSecurity Issue WLB-2019070132, IBM X-Force Vulnerability #164412, and Packet Storm Security File #153756.

Workarounds

• Implement server-side input sanitization using htmlspecialchars() or similar encoding functions for the speed parameter
• Deploy a reverse proxy or WAF with XSS filtering capabilities in front of the application
• Restrict network access to the prober script using firewall rules or .htaccess directives
• Add HTTP security headers including X-XSS-Protection, X-Content-Type-Options, and Content-Security-Policy

# Apache .htaccess configuration to restrict access
<Files "prober.php">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Files>