CVE-2025-15416: Wang.market Wangmarket XSS Vulnerability

CVE-2025-15416 Overview

CVE-2025-15416 is a stored cross-site scripting (XSS) vulnerability in xnx3 wangmarket versions up to 6.4. The flaw resides in the Add Global Variable Handler accessible through the /siteVar/save.do endpoint. An authenticated attacker can inject malicious script payloads through the Remark or Variable Value parameters. The injected script executes in the browser context of any user who later renders the affected page. The exploit details have been published, and the vendor wang.market did not respond to disclosure attempts. This vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact

Authenticated attackers can persistently inject JavaScript into the wangmarket administrative interface, enabling session theft, administrative action hijacking, and credential harvesting from other users.

Affected Products

• wang.market wangmarket versions up to and including 6.4
• Add Global Variable Handler component (/siteVar/save.do)
• Deployments exposing the administrative interface to untrusted users

Discovery Timeline

• 2026-01-01 - CVE-2025-15416 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-15416

Vulnerability Analysis

The vulnerability stems from missing output encoding and input sanitization in the global variable management workflow of wangmarket. When an authenticated user submits a new global variable through /siteVar/save.do, the application stores the Remark and Variable Value fields without neutralizing HTML or JavaScript content. The stored payload is later rendered in the application interface, causing arbitrary script execution in the victim's browser session.

Because the payload is persisted server-side, every subsequent visitor to the affected page triggers the injected script. This makes the issue more impactful than reflected XSS, since exploitation does not require crafted links or social engineering for each victim. The attack requires high privileges (an account capable of creating global variables) and user interaction to view the affected page.

Root Cause

The root cause is the absence of contextual output encoding for user-controlled fields handled by the Add Global Variable Handler. The application trusts authenticated input and renders the Remark and Variable Value content directly into HTML contexts. No allow-list filtering, HTML entity encoding, or Content Security Policy enforcement prevents script execution.

Attack Vector

An attacker with valid wangmarket credentials submits a POST request to /siteVar/save.do containing a script payload in either the Remark or Variable Value parameter. The payload is stored in the application database. When any user, including higher-privileged administrators, navigates to a page that renders the stored variable, the script executes with the victim's session privileges. Public proof-of-concept material is available in the GitHub Stored XSS Report.

Detection Methods for CVE-2025-15416

Indicators of Compromise

• POST requests to /siteVar/save.do containing HTML tags such as <script>, <img onerror=, or <svg onload= in form parameters
• Unexpected JavaScript execution or outbound requests originating from authenticated wangmarket admin sessions
• Database entries in the global variables table containing angle brackets, event handlers, or javascript: URIs
• Anomalous administrative actions performed shortly after a victim viewed a page with stored variables

Detection Strategies

• Inspect web server access logs for requests to /siteVar/save.do with payloads containing scripting syntax in the Remark or Variable Value fields
• Audit the wangmarket database for stored variable values containing HTML control characters or known XSS patterns
• Deploy a Content Security Policy in report-only mode to surface unexpected inline script execution within the application
• Correlate authentication events with administrative API calls to detect session abuse following XSS execution

Monitoring Recommendations

• Enable application-level logging that captures full request bodies for state-changing endpoints under /siteVar/
• Monitor for new admin user creation, permission changes, or configuration modifications occurring without corresponding interactive login activity
• Forward web application and authentication logs to a centralized analytics platform for behavioral correlation across sessions
• Track outbound HTTP requests from administrator browsers that target unrecognized external hosts

How to Mitigate CVE-2025-15416

Immediate Actions Required

• Restrict access to the wangmarket administrative interface using network controls, VPN, or IP allow-listing until a fix is available
• Review the global variables table for previously stored payloads containing HTML or JavaScript and remove malicious entries
• Rotate credentials and session tokens for accounts that may have viewed compromised pages
• Limit the number of accounts authorized to create or modify global variables

Patch Information

The vendor wang.market did not respond to disclosure attempts, and no official patch is referenced in the published advisory. Operators should track the vendor repository for updates and consider applying compensating controls. Refer to the VulDB entry for ongoing tracking.

Workarounds

• Deploy a web application firewall rule that blocks requests to /siteVar/save.do containing characters such as <, >, or javascript: in the Remark and Variable Value parameters
• Apply a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
• Implement server-side HTML entity encoding for stored variable fields before they are rendered in any view
• Disable the Add Global Variable functionality for non-essential roles through application configuration or reverse-proxy filtering

# Example WAF rule (ModSecurity) blocking script payloads on the vulnerable endpoint
SecRule REQUEST_URI "@streq /siteVar/save.do" \
  "phase:2,chain,deny,status:403,id:1015416,msg:'CVE-2025-15416 wangmarket stored XSS attempt'"
  SecRule ARGS:Remark|ARGS:'Variable Value' "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "t:none,t:urlDecodeUni,t:htmlEntityDecode"