CVE-2025-10711: 07FLYCMS Cross Site Scripting Vulnerability

CVE-2025-10711 Overview

CVE-2025-10711 is a cross-site scripting (XSS) vulnerability affecting 07FLYCMS, 07FLY-CMS, and 07FlyCRM up to version 20250831. The flaw resides in the /index.php/sysmanage/Login endpoint, where the Name parameter is not properly sanitized before being reflected back to the user. Attackers can inject arbitrary JavaScript that executes in the victim's browser context.

The vulnerability is remotely exploitable and requires user interaction. The exploit has been publicly disclosed. The vendor was contacted before disclosure but did not respond, so no official patch is available at this time.

Critical Impact
Remote attackers can execute arbitrary scripts in administrator browser sessions, enabling session hijacking, credential theft, and unauthorized actions within the CMS.

Affected Products

07FLYCMS up to version 20250831
07FLY-CMS up to version 20250831
07FlyCRM up to version 20250831

Discovery Timeline

2025-09-19 - CVE-2025-10711 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10711

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting (XSS) issue classified under [CWE-79]. The affected endpoint /index.php/sysmanage/Login processes the Name request parameter without applying output encoding or input sanitization. When the application echoes this value back into the HTML response, injected script tags execute in the visitor's browser.

Exploitation requires the victim to interact with a crafted link or form. Successful exploitation runs attacker-controlled JavaScript under the origin of the vulnerable CMS. This grants access to cookies, session tokens, and the DOM of authenticated pages.

The EPSS score is 0.339% with a percentile of 26.005, indicating a relatively low near-term exploitation likelihood despite the public disclosure.

Root Cause

The root cause is missing input validation and output encoding on the Name argument in the login handler. The application uses the parameter value directly in rendered HTML without applying context-appropriate escaping. Any special characters such as <, >, and " retain their literal meaning in the response markup.

Attack Vector

An attacker crafts a URL or HTML form targeting the /index.php/sysmanage/Login endpoint with a malicious payload in the Name parameter. The victim, typically an administrator navigating to the login page, triggers the payload upon clicking the link. The injected script runs in the victim's browser under the CMS origin, enabling theft of authentication material or execution of privileged actions on behalf of the user.

The vulnerability is described in the GitHub CVE Issue Discussion and cataloged in VulDB #324999.

Detection Methods for CVE-2025-10711

Indicators of Compromise

Web server access logs containing /index.php/sysmanage/Login requests with encoded or raw script markup in the Name parameter
Outbound requests from administrator browsers to unfamiliar domains shortly after visiting the login page
Unexpected session token usage from IP addresses that did not perform an interactive login

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the Name parameter for HTML tags, event handlers, and javascript: schemes
Correlate reflected XSS patterns in HTTP request bodies and query strings against known payload signatures such as <script>, onerror=, and onload=
Monitor DOM-based anomalies via Content Security Policy (CSP) violation reports if CSP is enforced

Monitoring Recommendations

Ingest web server access and error logs into a centralized log platform for query-based hunting
Alert on repeated failed login attempts to /index.php/sysmanage/Login originating from the same source with parameter anomalies
Track browser-side script errors reported by administrators as potential indicators of injection attempts

How to Mitigate CVE-2025-10711

Immediate Actions Required

Restrict administrative access to /index.php/sysmanage/Login using IP allowlists or VPN gating until a vendor patch is released
Deploy a WAF rule that blocks requests containing HTML or script syntax in the Name parameter
Instruct administrators to avoid clicking untrusted links referencing the CMS domain

Patch Information

No official patch is available. According to the disclosure, the vendor did not respond after being contacted. Organizations should track the VulDB entry and the GitHub issue tracker for updates. Consider migrating to an actively maintained CMS if the vendor remains unresponsive.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Apply server-side output encoding at a reverse proxy layer for parameters reflected on the login page
Set the HttpOnly and Secure attributes on session cookies to reduce the impact of stolen session material
Enable multi-factor authentication for administrative accounts so stolen sessions have limited value

bash

# Example nginx WAF-style rule blocking script markup in the Name parameter
if ($arg_Name ~* "(<script|onerror=|onload=|javascript:)") {
    return 403;
}