CVE-2025-15093: Sunkaifei Flycms XSS Vulnerability

CVE-2025-15093 Overview

CVE-2025-15093 is a reflected cross-site scripting (XSS) vulnerability in sunkaifei FlyCMS, a Java-based content management system. The flaw resides in the IndexAdminController.java file at src/main/java/com/flycms/web/system/, within the Admin Login component. Attackers can manipulate the redirectUrl parameter to inject arbitrary script content that executes in the victim's browser. The vulnerability is remotely exploitable and requires user interaction. Public exploit details have been released, and the vendor did not respond to disclosure attempts. FlyCMS uses continuous delivery with rolling releases, so no discrete affected or fixed version identifiers are available. The issue is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can execute arbitrary JavaScript in the context of an administrator's browser session by tricking users into clicking a crafted URL targeting the FlyCMS admin login endpoint.

Affected Products

sunkaifei FlyCMS up to commit abbaa5a8daefb146ad4d61027035026b052cb414
FlyCMS Admin Login component (IndexAdminController.java)
All rolling releases prior to remediation

Discovery Timeline

2025-12-26 - CVE-2025-15093 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-15093

Vulnerability Analysis

The vulnerability exists in the FlyCMS admin login flow implemented in IndexAdminController.java. The controller accepts a redirectUrl request parameter intended to route authenticated users to a destination page after login. The application reflects this parameter value into rendered output without proper output encoding or input sanitization. An attacker can craft a URL containing JavaScript payloads in the redirectUrl argument that the browser then parses and executes. Because the payload runs in the origin of the admin interface, it can access session cookies, perform authenticated actions on behalf of the administrator, and modify the login page displayed to users. The vulnerability requires user interaction, meaning a victim must click or visit the crafted link.

Root Cause

The root cause is missing neutralization of user-supplied input in the redirectUrl parameter before it is included in the HTTP response body or a client-side redirect handler. The controller trusts the parameter and echoes it back into the page without HTML entity encoding, JavaScript escaping, or URL validation against an allowlist of internal destinations.

Attack Vector

The attack is delivered remotely over the network. An attacker constructs a URL pointing at the FlyCMS admin login endpoint with a malicious redirectUrl value containing an XSS payload. The attacker distributes the link through phishing, forum posts, or other social channels. When an administrator or authenticated user clicks the link, the injected script executes in their browser under the FlyCMS origin. See the FlyCMS Issue Tracker and VulDB entry #338422 for additional technical detail.

No verified proof-of-concept code is included here. Refer to the VulDB CTI record for public exploit references.

Detection Methods for CVE-2025-15093

Indicators of Compromise

HTTP requests to FlyCMS admin login endpoints containing redirectUrl parameters with <script>, javascript:, onerror=, or encoded script fragments
Web server or reverse proxy logs showing unusually long or URL-encoded redirectUrl values referencing external domains
Browser console errors or Content Security Policy violation reports originating from the FlyCMS admin login page
Unexpected outbound requests from administrator browsers to attacker-controlled domains following a login attempt

Detection Strategies

Inspect access logs for query strings targeting IndexAdminController routes with suspicious redirectUrl values
Deploy a web application firewall (WAF) rule that flags reflected script patterns in the redirectUrl parameter
Correlate administrator authentication events with outbound network traffic to unrecognized destinations

Monitoring Recommendations

Enable verbose HTTP access logging on the FlyCMS front-end and retain logs for retrospective hunting
Alert on any request where redirectUrl contains characters such as <, >, ", or the string javascript: after URL decoding
Monitor administrator session activity for anomalous actions performed shortly after login redirects

How to Mitigate CVE-2025-15093

Immediate Actions Required

Restrict access to the FlyCMS admin interface to trusted networks or VPN-only sources until a fix is applied
Instruct administrators not to click FlyCMS login links received from untrusted sources
Apply a WAF rule to strip or block redirectUrl values that contain HTML or JavaScript metacharacters
Enforce a strict Content Security Policy (CSP) that disallows inline script execution on admin pages

Patch Information

The vendor was contacted but did not respond, and FlyCMS uses continuous delivery with rolling releases. No official patch identifier or fixed version is published. Track the FlyCMS repository and Issue #15 for remediation updates. Organizations maintaining local builds should patch IndexAdminController.java to validate redirectUrl against an allowlist of internal paths and HTML-encode any reflected value.

Workarounds

Modify IndexAdminController.java to validate that redirectUrl is a relative path beginning with / and rejects protocol-relative or absolute URLs
Apply server-side HTML entity encoding to any reflected redirectUrl value before rendering
Deploy a reverse proxy rule that drops requests where the redirectUrl parameter contains <, >, ", ', or javascript: after decoding
Set HttpOnly and Secure flags on admin session cookies to limit impact if script execution occurs

bash

# Example nginx rule to block suspicious redirectUrl values on the FlyCMS admin login
location ~ /admin/ {
    if ($arg_redirectUrl ~* "(<|>|script|javascript:|onerror=|onload=)") {
        return 403;
    }
    proxy_pass http://flycms_backend;
}