CVE-2025-14244: GreenCMS Menu Management XSS Vulnerability

CVE-2025-14244 Overview

CVE-2025-14244 is a cross-site scripting (XSS) vulnerability in GreenCMS version 2.3.0603. The flaw resides in the Menu Management Page component, specifically within /Admin/Controller/CustomController.class.php. Attackers can manipulate the Link argument to inject malicious script content that executes in the browsers of administrators viewing the menu interface.

The vulnerability is remotely exploitable and requires an authenticated user with high privileges combined with victim interaction. A public exploit has been disclosed. GreenCMS 2.3.0603 is no longer supported by the maintainer, meaning no official fix will be issued for this branch.

Critical Impact
Authenticated attackers can inject persistent JavaScript through the menu Link field, enabling session theft, administrative action forgery, and browser-based attacks against other administrators.

Affected Products

Njtech GreenCMS 2.3.0603
GreenCMS Admin CustomController.class.php (Menu Management component)
Unsupported GreenCMS 2.x release branch

Discovery Timeline

2025-12-08 - CVE-2025-14244 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14244

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. GreenCMS accepts user-supplied input for the Link parameter through the Menu Management Page but fails to properly sanitize or encode the value before rendering it in the administrative interface. When an administrator later loads the menu view, the injected payload executes in the context of the authenticated admin session.

Exploitation requires network access to the admin panel and an account with elevated privileges to submit menu entries. A second administrator must then load the page containing the malicious link, satisfying the user interaction requirement. Successful exploitation compromises session confidentiality and integrity within the admin console.

Because the impacted GreenCMS release is end-of-life, the vulnerability will remain unpatched in that branch. Deployments still running version 2.3.0603 carry ongoing exposure regardless of network segmentation of the admin interface.

Root Cause

The root cause is missing output encoding and input validation on the Link argument handled by CustomController.class.php. The controller stores attacker-controlled markup verbatim and reflects it into rendered HTML without contextual escaping, allowing arbitrary JavaScript execution.

Attack Vector

An attacker with an authenticated high-privilege account submits a crafted Link value containing JavaScript through the Menu Management form. The payload persists in the CMS data store. When another administrator opens the menu page, the browser parses the injected content and executes the attacker's script under the admin origin.

No verified code examples are available for this vulnerability. Refer to the published GitHub gist proof of concept and the VulDB entry #334754 for technical details.

Detection Methods for CVE-2025-14244

Indicators of Compromise

Menu records in GreenCMS containing <script>, javascript:, onerror=, or other HTML event handlers in the Link field.
Web server access logs showing POST requests to admin endpoints tied to CustomController with encoded angle brackets or script tokens in body parameters.
Unexpected outbound requests from administrator browsers to attacker-controlled domains after visiting the menu management page.

Detection Strategies

Query the CMS database for menu entries where the Link column contains HTML tags, protocol handlers, or event attribute strings.
Deploy a web application firewall rule that inspects requests targeting the Menu Management Page for XSS patterns in the Link parameter.
Enable a strict Content Security Policy and monitor report-uri submissions for violations originating from the admin panel.

Monitoring Recommendations

Audit administrative account activity for unusual menu creation or modification events, especially from newly created high-privilege accounts.
Correlate admin panel access logs with browser-side telemetry to detect script execution anomalies during menu page loads.
Alert on any process launched by a browser session shortly after an administrator authenticates to GreenCMS.

How to Mitigate CVE-2025-14244

Immediate Actions Required

Migrate off GreenCMS 2.3.0603 to a supported CMS platform, since the affected version is end-of-life and will not receive vendor patches.
Restrict access to the GreenCMS admin panel using network allow-lists, VPN, or reverse-proxy authentication until migration completes.
Review all existing menu entries and remove any Link values containing HTML markup, script tags, or non-http(s) URI schemes.

Patch Information

No vendor patch is available. The maintainer no longer supports the affected GreenCMS branch. Organizations must plan migration to a maintained content management platform or apply compensating controls at the reverse proxy or WAF layer.

Workarounds

Deploy a WAF rule blocking requests to admin endpoints where the Link parameter contains <, >, javascript:, or event handler substrings.
Enforce a restrictive Content Security Policy that disallows inline scripts and unauthorized script sources for the admin interface.
Limit high-privilege administrative accounts and require multi-factor authentication to reduce the pool of users who can inject payloads.

bash

# Example nginx location block restricting admin panel access by source IP
location /Admin/ {
    allow 10.0.0.0/24;
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'";
    proxy_pass http://greencms_backend;
}