CVE-2025-15144: Xunruicms XSS Vulnerability

CVE-2025-15144 Overview

CVE-2025-15144 is a reflected cross-site scripting (XSS) vulnerability in dayrui XunRuiCMS versions up to 4.7.1. The flaw resides in the dr_show_error and dr_exit_msg functions inside /dayrui/Fcms/Init.php, which handle JSONP callback output. Attackers can manipulate the callback argument to inject arbitrary script content that executes in the victim's browser. The vulnerability is remotely exploitable and requires user interaction, such as clicking a crafted link. The exploit details have been made public, and the vendor did not respond to disclosure attempts.

Critical Impact
Remote attackers can execute arbitrary JavaScript in a victim's browser session by luring users to a crafted URL targeting the JSONP callback handler.

Affected Products

dayrui XunRuiCMS versions up to and including 4.7.1
Component: JSONP Callback Handler (/dayrui/Fcms/Init.php)
Affected functions: dr_show_error and dr_exit_msg

Discovery Timeline

2025-12-28 - CVE-2025-15144 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-15144

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting (XSS) flaw classified under [CWE-79]. XunRuiCMS exposes JSONP endpoints that echo the callback request parameter directly into the HTTP response. The dr_show_error and dr_exit_msg functions in /dayrui/Fcms/Init.php fail to sanitize or validate the callback value before rendering it. As a result, an attacker-controlled string is reflected into the response body and executed by the browser when interpreted as JavaScript or HTML.

Because the sink is a JSONP handler, the response is typically served with a JavaScript content type, expanding the range of injection primitives. The public exploit indicates attackers can craft URLs that trigger script execution in the context of the vulnerable site.

Root Cause

The root cause is missing input validation on the callback parameter. JSONP callback values must conform to a strict identifier pattern, typically matching ^[a-zA-Z_$][a-zA-Z0-9_$]*$. The affected functions accept arbitrary characters, allowing injection of HTML tags, script payloads, or JavaScript expressions that break out of the intended callback identifier.

Attack Vector

Exploitation requires network access to the vulnerable application and user interaction. An attacker crafts a URL to the JSONP endpoint with a malicious callback value and delivers it through phishing, forum posts, or malvertising. When the victim visits the link, the reflected payload executes in the origin of the XunRuiCMS site, enabling session cookie theft, credential harvesting through injected forms, or actions performed on behalf of the authenticated user. See the VulDB advisory for technical references.

Detection Methods for CVE-2025-15144

Indicators of Compromise

HTTP requests to /dayrui/Fcms/Init.php or JSONP endpoints containing non-alphanumeric characters in the callback parameter
Callback values containing <, >, ", ', script, or URL-encoded equivalents such as %3Cscript%3E
Referrers originating from external domains delivering suspicious query strings to XunRuiCMS URLs

Detection Strategies

Deploy web application firewall rules that reject callback parameters not matching a strict JavaScript identifier pattern
Inspect web server access logs for unusually long callback values or those containing HTML metacharacters
Correlate outbound requests from user browsers to attacker-controlled domains immediately after visits to XunRuiCMS pages

Monitoring Recommendations

Enable verbose logging of query strings on reverse proxies fronting XunRuiCMS deployments
Monitor for spikes in 200-response JSONP endpoint hits paired with unusual User-Agent or Referer headers
Alert on Content Security Policy (CSP) violation reports referencing inline script execution on CMS pages

How to Mitigate CVE-2025-15144

Immediate Actions Required

Restrict public access to /dayrui/Fcms/Init.php and JSONP endpoints until a patched release is available
Deploy WAF rules that enforce a strict allowlist regex on the callback parameter
Add a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins

Patch Information

The vendor did not respond to disclosure attempts, and no official patch has been published at the time of NVD publication. Administrators should monitor the XunRuiCMS project for updates and consider migrating to a maintained CMS if a fix is not released.

Workarounds

Modify dr_show_error and dr_exit_msg in /dayrui/Fcms/Init.php to validate the callback value against ^[a-zA-Z_$][a-zA-Z0-9_$]{0,63}$ and reject non-conforming input
Apply HTML entity encoding to any reflected output that cannot be strictly validated
Set the X-Content-Type-Options: nosniff header and serve JSONP responses only with application/javascript

bash

# Example nginx rule to block malformed JSONP callback values
if ($arg_callback ~* "[^a-zA-Z0-9_$]") {
    return 400;
}