CVE-2025-15451: xnx3 Wangmarket XSS Vulnerability

CVE-2025-15451 Overview

A Cross-Site Scripting (XSS) vulnerability has been discovered in xnx3 wangmarket versions up to 4.9. This security flaw affects the System Variables Page functionality, specifically within the file /admin/system/variableSave.do. The vulnerability allows attackers to inject malicious scripts through manipulation of the Description argument, potentially enabling session hijacking, credential theft, and unauthorized actions within the administrative context.

Critical Impact

Authenticated attackers with administrative privileges can inject malicious scripts that execute in the browsers of other users accessing the System Variables Page, potentially leading to session hijacking or administrative account compromise.

Affected Products

• xnx3 wangmarket up to version 4.9
• System Variables Page component (/admin/system/variableSave.do)

Discovery Timeline

• 2026-01-05 - CVE-2025-15451 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-15451

Vulnerability Analysis

This stored Cross-Site Scripting (XSS) vulnerability resides in the System Variables management functionality of the wangmarket content management system. The flaw originates from insufficient input validation and output encoding when processing the Description parameter in the /admin/system/variableSave.do endpoint.

When an administrator submits data through the System Variables Page, the application fails to properly sanitize user-supplied input in the Description field before storing it in the database. Subsequently, when this data is rendered on the page, the malicious script content executes in the context of the viewing user's browser session.

The vulnerability requires network access and authenticated administrative privileges to exploit, with user interaction required for the malicious payload to trigger. The exploit has been publicly disclosed, increasing the risk of active exploitation attempts.

Root Cause

The root cause of this vulnerability is improper input validation (CWE-79) in the System Variables Page component. The application accepts arbitrary input in the Description argument without adequately sanitizing or encoding special characters before storing and rendering the data. This allows HTML and JavaScript content to be interpreted as executable code rather than treated as plain text.

Attack Vector

The attack vector is network-based, targeting the administrative interface of the wangmarket CMS. An attacker with administrative privileges can craft a malicious payload containing JavaScript code and submit it through the Description field of the System Variables Page. When other administrators or users view this page, the injected script executes within their browser context.

The attack flow typically involves:

1. Attacker authenticates to the administrative panel with elevated privileges
2. Navigates to the System Variables Page at /admin/system/variableSave.do
3. Injects malicious JavaScript in the Description parameter
4. The payload is stored and subsequently executed when other users view the affected page

Technical details and proof-of-concept information are available in the Yuque Security Document.

Detection Methods for CVE-2025-15451

Indicators of Compromise

• Unusual JavaScript content in system variable descriptions within the database
• HTTP requests to /admin/system/variableSave.do containing <script> tags, event handlers (e.g., onerror, onload), or JavaScript URIs
• Evidence of session token exfiltration or unauthorized administrative actions following access to the System Variables Page

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XSS payloads in POST requests to /admin/system/variableSave.do
• Monitor application logs for suspicious patterns in the Description parameter including encoded script tags or event handler attributes
• Deploy endpoint detection solutions to identify browser-based attacks resulting from XSS exploitation
• Utilize SentinelOne Singularity to detect post-exploitation activity such as credential theft or lateral movement initiated through XSS attacks

Monitoring Recommendations

• Enable detailed logging for all administrative panel activities, particularly modifications to system variables
• Implement Content Security Policy (CSP) headers and monitor for CSP violations that may indicate XSS attempts
• Review database records in the system variables table for unexpected HTML or JavaScript content
• Monitor for anomalous administrative sessions or actions that may indicate session hijacking

How to Mitigate CVE-2025-15451

Immediate Actions Required

• Restrict access to the administrative panel (/admin/) to trusted IP addresses only
• Review existing system variable descriptions for malicious content and sanitize any suspicious entries
• Implement Content Security Policy headers to mitigate the impact of successful XSS attacks
• Consider disabling or restricting access to the System Variables Page until a patch is available

Patch Information

At the time of publication, the vendor (xnx3) has not released an official security patch for this vulnerability. According to the disclosure, the vendor was contacted early about this issue but did not respond. Organizations using wangmarket should monitor for security updates from the vendor and apply patches immediately when available.

For additional vulnerability details, refer to the VulDB entry #339484.

Workarounds

• Apply input validation and output encoding at the application level by modifying the variableSave.do handler to sanitize the Description parameter
• Implement a Web Application Firewall (WAF) rule to filter XSS patterns in requests to the affected endpoint
• Use browser security extensions and CSP headers to prevent execution of inline scripts
• Limit administrative access to essential personnel and enforce multi-factor authentication to reduce the attack surface

# Example: Apache ModSecurity WAF rule to block XSS in Description parameter
SecRule ARGS:Description "@rx (?i)(<script|javascript:|on\w+\s*=)" \
    "id:100001,phase:2,deny,status:403,msg:'Potential XSS in Description parameter'"