CVE-2025-15451: Wangmarket XSS Vulnerability Explained

CVE-2025-15451 Overview

CVE-2025-15451 is a cross-site scripting (XSS) vulnerability affecting xnx3 wangmarket versions up to 4.9. The flaw resides in the System Variables Page accessed through /admin/system/variableSave.do. An authenticated attacker can manipulate the Description argument to inject malicious script content. The vulnerability has been publicly disclosed and exploit details are available. The vendor was contacted prior to disclosure but did not respond.

Critical Impact
Authenticated attackers with high privileges can inject script payloads through the System Variables interface, enabling session hijacking or administrative action abuse against other users of the application [CWE-79].

Affected Products

xnx3 wangmarket versions up to and including 4.9
wang.market:wangmarket administrative System Variables component
Deployments exposing /admin/system/variableSave.do over the network

Discovery Timeline

2026-01-05 - CVE-2025-15451 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-15451

Vulnerability Analysis

The vulnerability is a stored cross-site scripting issue in the System Variables Page of xnx3 wangmarket. The application accepts user-controlled input in the Description parameter submitted to /admin/system/variableSave.do without applying sufficient output encoding. When the stored value is later rendered in the administrative interface, the browser executes the attacker-supplied script in the context of the authenticated session.

Exploitation requires high privileges and user interaction, which limits the practical attack surface. However, because the payload is persistent, any administrator viewing the affected page becomes a target. Successful injection can lead to session theft, forced administrative actions, or chained attacks against the back-office workflow.

The EPSS probability remains low, reflecting limited observed exploitation activity to date. Despite this, public exploit material has been released, increasing the likelihood of opportunistic abuse against unpatched instances.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The Description field in the System Variables save handler is stored and rendered without HTML entity encoding or context-aware sanitization, allowing arbitrary HTML and JavaScript to persist within the administrative UI.

Attack Vector

The attack vector is network-based. An attacker with high-privilege access to the administrative console submits a crafted Description value to /admin/system/variableSave.do. The payload is stored server-side and executed whenever another authenticated user views the System Variables page. Exploitation requires the target to interact with the affected page. Refer to the VulDB advisory for CVE-2025-15451 and the Yuque technical write-up for additional technical context.

No verified exploit code is reproduced here. See the referenced advisories for proof-of-concept details.

Detection Methods for CVE-2025-15451

Indicators of Compromise

POST requests to /admin/system/variableSave.do containing HTML tags, <script> fragments, or JavaScript event handlers in the Description parameter
Stored System Variable records whose Description field contains encoded payloads such as javascript:, onerror=, or onload=
Unexpected outbound requests from administrator browsers to attacker-controlled domains following access to the System Variables page

Detection Strategies

Inspect web server and application access logs for write operations targeting /admin/system/variableSave.do with suspicious payload patterns in form parameters
Apply web application firewall (WAF) signatures that flag HTML and JavaScript constructs in administrative POST bodies
Perform database integrity reviews on the System Variables table to identify entries containing markup that should not appear in descriptive text

Monitoring Recommendations

Alert on administrative form submissions originating from unusual source IP addresses or outside business hours
Track Content Security Policy (CSP) violation reports from the administrative interface
Monitor session activity for administrators whose accounts have recently viewed modified System Variables records

How to Mitigate CVE-2025-15451

Immediate Actions Required

Restrict network access to the /admin/system/ path so that only trusted operator networks can reach the administrative endpoints
Audit existing System Variables entries and remove any Description values containing HTML or scripting constructs
Enforce least-privilege on administrative accounts and rotate credentials for any account suspected of misuse

Patch Information

No vendor patch has been published. The vendor did not respond to disclosure outreach according to the public advisory. Operators should track the VulDB entry for CVE-2025-15451 for updates and consider migrating away from affected versions if a fix is not released.

Workarounds

Deploy a WAF rule that blocks HTML tags and JavaScript event handlers in the Description parameter of /admin/system/variableSave.do
Implement a strict Content Security Policy on the administrative interface to prevent inline script execution
Require multi-factor authentication for all administrator accounts to reduce the risk of privileged credential abuse

bash

# Example NGINX rule blocking script payloads in the Description parameter
location /admin/system/variableSave.do {
    if ($request_method = POST) {
        if ($request_body ~* "(<script|javascript:|onerror=|onload=)") {
            return 403;
        }
    }
    proxy_pass http://wangmarket_backend;
}