CVE-2025-14006: Xunruicms XSS Vulnerability in CMS Platform

CVE-2025-14006 Overview

CVE-2025-14006 is a cross-site scripting (XSS) vulnerability in dayrui XunRuiCMS through version 4.7.1. The flaw resides in the Add Data Validation Page component, reachable via /admind45f74adbd95.php?c=field&m=add&rname=site&rid=1&page=1. Attackers manipulate the data[name] parameter to inject script content that executes in the context of an authenticated administrator session. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts.

Critical Impact
An authenticated attacker with low privileges can inject arbitrary JavaScript that runs in a victim administrator's browser, enabling session theft, forced admin actions, and CMS backend compromise.

Affected Products

dayrui XunRuiCMS versions up to and including 4.7.1
Component: Add Data Validation Page (admind45f74adbd95.php with c=field&m=add)
Parameter: data[name]

Discovery Timeline

2025-12-04 - CVE-2025-14006 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14006

Vulnerability Analysis

The vulnerability is a reflected or stored cross-site scripting issue in the field administration workflow of XunRuiCMS. When an administrator submits a new data validation rule through the Add Data Validation Page, the application accepts the data[name] parameter without adequate HTML encoding or input sanitization. The unsanitized value is later rendered into an HTML response, where the browser interprets embedded markup as executable script.

Because the affected endpoint sits behind the CMS admin panel, exploitation requires low-privilege authentication and user interaction from a victim who visits or renders the crafted content. Successful execution runs in the origin of the administrator's session, giving the payload access to session cookies, CSRF tokens, and any privileged administrative functionality exposed to the browser. Public disclosure of the exploit increases the likelihood of opportunistic abuse against internet-facing XunRuiCMS installations.

Root Cause

The root cause is missing output encoding and input validation on the data[name] field handled by the field controller's add action. The CMS trusts administrator-supplied input and reflects it back into rendered HTML without contextual escaping, violating standard defense-in-depth practices for user-controlled string handling.

Attack Vector

The attack is network-based and requires an authenticated administrator to submit or view crafted content. An attacker with backend access can inject a payload into data[name] when adding a validation rule. When another admin views the affected page or listing, the payload executes in the browser, allowing the attacker to hijack the session, pivot to further backend functions, or plant persistent scripts. See the GitHub XSS Vulnerability Report and VulDB entry #334248 for the disclosed proof of concept.

Detection Methods for CVE-2025-14006

Indicators of Compromise

HTTP requests to /admind45f74adbd95.php?c=field&m=add&rname=site&rid=1&page=1 containing <script>, onerror=, onload=, or javascript: substrings in the data[name] parameter.
Admin panel responses that reflect unescaped angle brackets or event handler attributes originating from stored field metadata.
Unusual outbound requests from administrator browsers to attacker-controlled domains shortly after visiting CMS field management pages.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST bodies and query strings to the XunRuiCMS admin endpoints for XSS payload signatures.
Enable server-side logging of all c=field&m=add requests and alert on parameter values containing HTML control characters.
Correlate administrator session activity with anomalous JavaScript-triggered API calls to detect payload execution in real time.

Monitoring Recommendations

Monitor authentication logs for administrator logins from unexpected geolocations that immediately access field configuration endpoints.
Track integrity of stored validation rule records to identify unauthorized modifications containing script fragments.
Review browser Content Security Policy (CSP) violation reports from admin sessions for blocked inline script executions.

How to Mitigate CVE-2025-14006

Immediate Actions Required

Restrict access to the XunRuiCMS admin path (including the obfuscated admind45f74adbd95.php entry point) to trusted IP ranges or VPN networks.
Review recently created or modified validation rules and remove any entries whose data[name] value contains HTML or script content.
Rotate administrator credentials and invalidate active sessions if suspicious field entries or logins are identified.

Patch Information

At the time of publication, no vendor patch has been released. The advisory notes the vendor was contacted early about disclosure but did not respond. Monitor the VulDB record #334248 and the vendor's official channels for a fixed release. Until a patch is available, treat all XunRuiCMS 4.7.1 and earlier deployments as vulnerable.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and unknown external script origins on admin pages.
Place the CMS behind a WAF configured to block XSS payload patterns targeting data[name] and similar admin parameters.
Limit administrator accounts and apply least-privilege role assignments to reduce the impact of a compromised low-privilege admin session.
Require multi-factor authentication for all backend logins to raise the cost of session hijacking.

bash

# Example NGINX rule to block obvious XSS payloads on the vulnerable endpoint
location ~ ^/admind45f74adbd95\.php$ {
    if ($args ~* "(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
    if ($request_body ~* "data\[name\]=.*(<script|onerror=|onload=)") {
        return 403;
    }
    proxy_pass http://xunruicms_backend;
}