CVE-2025-10710: 07FLYCMS XSS Vulnerability

CVE-2025-10710 Overview

CVE-2025-10710 is a reflected cross-site scripting (XSS) vulnerability affecting 07FLYCMS, 07FLY-CMS, and 07FlyCRM builds up to version 20250831. The flaw resides in an unspecified code path within /index.php and is triggered through manipulation of the Name parameter. Attackers can inject malicious script content that executes in the browser context of any user who interacts with a crafted request. The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts. The weakness is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Remote attackers can execute arbitrary JavaScript in a victim's browser session, enabling session token theft, credential harvesting, and unauthorized actions in the CMS or CRM interface.

Affected Products

07FLYCMS up to build 20250831
07FLY-CMS up to build 20250831
07FlyCRM up to build 20250831

Discovery Timeline

2025-09-19 - CVE-2025-10710 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10710

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the shared codebase used by 07FLYCMS, 07FLY-CMS, and 07FlyCRM. The application accepts the Name argument submitted to /index.php and reflects the value back into an HTML response without sufficient output encoding or input sanitization. When a victim's browser renders the response, attacker-supplied markup and script content execute in the origin of the affected site.

Exploitation requires user interaction, typically achieved by tricking a victim into clicking a crafted link. Because the affected products are content management and customer relationship management platforms, sessions targeted by the attack often belong to administrative or sales users with elevated privileges. Successful exploitation can lead to session hijacking, forced actions through the authenticated UI, and theft of customer data displayed in the CRM interface.

Root Cause

The root cause is improper neutralization of user-controlled input during HTML page generation, matching the CWE-79 pattern. The Name parameter is passed to /index.php and echoed into the response without HTML entity encoding or context-aware escaping.

Attack Vector

The attack is delivered over the network and requires a targeted user to load an attacker-supplied URL. The attacker constructs a request to /index.php that includes a Name parameter containing JavaScript payload markup. When the victim visits the link while authenticated, the script executes in the victim's browser context. No authentication is required on the attacker's side, but victim interaction is necessary. Public disclosure via the GitHub CVE Issue Discussion and VulDB #324998 provides technical detail on the parameter and endpoint involved.

Detection Methods for CVE-2025-10710

Indicators of Compromise

HTTP requests to /index.php where the Name parameter contains HTML tags, script fragments, or event handlers such as <script>, onerror=, or onload=.
URL-encoded payloads targeting the Name argument, including sequences such as %3Cscript%3E or %3Cimg.
Referrer headers pointing to external phishing pages that redirect users to crafted 07FLYCMS or 07FlyCRM URLs.

Detection Strategies

Deploy a web application firewall rule that inspects the Name query and body parameter on requests to /index.php and blocks common XSS token patterns.
Review web server access logs for anomalous long or encoded values in the Name parameter accompanied by unusual referrers.
Monitor browser-side Content Security Policy (CSP) violation reports for inline script executions on pages served by the affected applications.

Monitoring Recommendations

Correlate authenticated session activity with recent inbound clicks to /index.php, focusing on administrative accounts.
Alert on outbound requests from user browsers to unfamiliar domains that follow requests to the affected CMS or CRM endpoints, which may indicate exfiltration by injected scripts.
Track failed and successful logins that occur shortly after suspicious Name parameter values are observed in logs.

How to Mitigate CVE-2025-10710

Immediate Actions Required

Restrict public exposure of 07FLYCMS, 07FLY-CMS, and 07FlyCRM instances by placing them behind a VPN or IP allowlist until a fix is available.
Deploy WAF signatures that block XSS payloads targeting the Name parameter on /index.php.
Enforce a strict Content-Security-Policy header that disallows inline scripts and restricts script sources to trusted origins.
Rotate session cookies and administrative credentials if suspicious Name parameter values are found in historical logs.

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted early but did not respond. Organizations should track the GitHub CVE Issue Discussion and VulDB CTI Issue #324998 for future updates.

Workarounds

Add a reverse proxy rule that HTML-encodes or strips angle brackets and quote characters from the Name parameter before requests reach /index.php.
Set the HttpOnly and Secure flags on all session cookies to reduce the impact of script-based token theft.
Require administrators to use a dedicated browser profile or isolated browser session when accessing the affected applications.

bash

# Example NGINX rule to block script-like content in the Name parameter
if ($arg_Name ~* "(<|%3C)\s*script|onerror\s*=|onload\s*=|javascript:") {
    return 403;
}