CVE-2025-14519: Baowzh Hfly XSS Vulnerability

CVE-2025-14519 Overview

CVE-2025-14519 is a stored cross-site scripting (XSS) vulnerability affecting the baowzh hfly PHP-based travel website CMS. The flaw resides in the advtext module and is reachable through the /admin/index.php/advtext/add endpoint. An authenticated attacker with low privileges can inject persistent JavaScript that executes in the browser of any user who views the affected content. The vendor operates a rolling-release model, so no fixed version identifier is available. According to the disclosure, the vendor was contacted early but did not respond. The issue is classified under CWE-79.

Critical Impact
Attackers can persist arbitrary JavaScript in the advtext module and hijack administrator sessions, deface pages, or pivot to further attacks against authenticated users.

Affected Products

baowzh hfly (rolling release up to commit 638ff9abe9078bc977c132b37acbe1900b63491c)
advtext module exposed via /admin/index.php/advtext/add
Deployments of the PHP-based travel website CMS built on baowzh:hfly

Discovery Timeline

2025-12-11 - CVE-2025-14519 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14519

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the administrative interface of hfly. The advtext add function accepts user-controlled input without sufficient output encoding or input sanitization. When an authenticated administrator or contributor submits a crafted payload through /admin/index.php/advtext/add, the malicious markup is written into persistent storage. The payload later renders in any browser that loads pages consuming the stored advtext content. Because the injection is persistent, exploitation does not require any additional user interaction beyond visiting the affected view. The disclosure states the exploit has been publicly released, which raises opportunistic reuse risk against exposed instances.

Root Cause

The root cause is missing or insufficient sanitization and contextual output encoding of input processed by the advtext add handler. Untrusted characters, including HTML control characters and script markup, are stored verbatim and later reflected into HTML contexts. This aligns with CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack is remote and requires low privileges plus user interaction from the victim who views the injected content. An attacker with access to the admin advtext/add function submits a payload that includes JavaScript. Every subsequent user who loads the affected view executes the payload in the origin of the vulnerable CMS. Impact can include session token theft, forced administrative actions via CSRF chaining, and content tampering.

See the GitHub XSS Advisory Document and the VulDB CVE Analysis #335857 for the published proof-of-concept details.

Detection Methods for CVE-2025-14519

Indicators of Compromise

HTTP POST requests to /admin/index.php/advtext/add containing <script>, onerror=, onload=, javascript:, or encoded variants in form parameters.
Stored advtext records that include HTML tags, event handlers, or external script references.
Outbound requests from administrator browsers to unfamiliar domains shortly after loading pages that render advtext content.
Unexpected session or cookie exfiltration patterns originating from admin sessions.

Detection Strategies

Inspect web server access logs for POST /admin/index.php/advtext/add requests and correlate the source IP, user agent, and authenticated user.
Run database queries against the advtext table to identify entries containing script markup or event handler attributes.
Deploy web application firewall (WAF) signatures that flag common XSS payload patterns targeting the advtext endpoint.

Monitoring Recommendations

Alert on newly created or modified advtext records outside of change-management windows.
Monitor administrator session activity for anomalous XHR or fetch requests to external hosts.
Enable Content Security Policy (CSP) violation reporting to surface inline script execution attempts.

How to Mitigate CVE-2025-14519

Immediate Actions Required

Restrict access to /admin/index.php/advtext/add to trusted network ranges or via VPN until sanitization is verified.
Audit existing advtext records for stored payloads and remove any entries containing HTML or script content.
Rotate administrator credentials and invalidate active sessions if suspicious advtext submissions are found.
Enforce strong authentication and least-privilege access for accounts that can post advtext entries.

Patch Information

The vendor uses a rolling-release delivery model and, per the disclosure, did not respond to the reporter. No official fixed version identifier is published. Operators should track the upstream baowzh/hfly repository for commits addressing input sanitization in the advtext module and apply them promptly. Refer to the VulDB CVE Analysis #335857 and VulDB Submission #702943 for ongoing status.

Workarounds

Deploy a WAF rule that blocks HTML tags and JavaScript event handlers in POST parameters submitted to /admin/index.php/advtext/add.
Apply a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Implement server-side output encoding for all rendered advtext fields, using context-appropriate HTML entity encoding.
Temporarily disable the advtext module if it is not required for business operations.

bash

# Example NGINX WAF-style rule to block obvious XSS payloads on the advtext endpoint
location = /admin/index.php/advtext/add {
    if ($request_method = POST) {
        if ($request_body ~* "(<script|onerror=|onload=|javascript:)") {
            return 403;
        }
    }
    proxy_pass http://php_backend;
}