CVE-2025-1949: Zzcms Cross Site Scripting Vulnerability

CVE-2025-1949 Overview

CVE-2025-1949 is a reflected cross-site scripting (XSS) vulnerability in ZZCMS 2025. The flaw resides in the URL Handler component of /3/ucenter_api/code/register_nodb.php, where the application echoes the $_SERVER['PHP_SELF'] value without proper output encoding. An unauthenticated remote attacker can craft a URL that injects arbitrary JavaScript into the response. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed ZZCMS instances. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, and content manipulation on affected ZZCMS 2025 deployments.

Affected Products

ZZCMS 2025
Component: URL Handler in /3/ucenter_api/code/register_nodb.php
Parameter: $_SERVER['PHP_SELF']

Discovery Timeline

2025-03-04 - CVE-2025-1949 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1949

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the ZZCMS 2025 user center registration script register_nodb.php. The script uses the $_SERVER['PHP_SELF'] PHP superglobal when generating HTML output, typically inside form action attributes or navigation links. Because PHP populates $_SERVER['PHP_SELF'] from the requested URI, an attacker can append attacker-controlled path segments and query data that PHP treats as part of the script name.

When the value is emitted without HTML entity encoding, injected markup executes in the victim's browser under the origin of the ZZCMS site. The attack requires user interaction (UI:P), typically clicking a crafted link, but no authentication is needed. A successful payload runs with the privileges of the visiting user, including any authenticated session cookies not protected by the HttpOnly flag.

Root Cause

The root cause is missing output encoding on data derived from $_SERVER['PHP_SELF']. PHP does not sanitize this superglobal, and developers must apply htmlspecialchars() before rendering. In register_nodb.php, the value is reflected directly into the HTML response, allowing script context breakout via characters such as ", <, and >.

Attack Vector

The attack is remote and network-based. An adversary crafts a URL of the form https://target/3/ucenter_api/code/register_nodb.php/"><script>...</script> and delivers it via phishing, malicious advertising, or a compromised site. When a victim visits the link, the injected payload executes in the ZZCMS origin, enabling cookie theft, forced actions, or drive-by redirection. No verified proof-of-concept code has been published beyond the reference write-up on the GitHub PoC Repository.

Detection Methods for CVE-2025-1949

Indicators of Compromise

Web server access logs containing requests to /3/ucenter_api/code/register_nodb.php/ with appended path segments containing <script>, onerror=, javascript:, or URL-encoded equivalents (%3Cscript%3E).
Referer headers on internal ZZCMS pages originating from external phishing domains.
Unexpected outbound requests from user browsers to attacker-controlled hosts immediately after visiting the vulnerable endpoint.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the URI path and query string for XSS metacharacters targeting register_nodb.php.
Enable server-side logging of full request URIs and review for anomalous path traversal-like segments after the PHP script name.
Perform authenticated dynamic application security testing (DAST) against ZZCMS endpoints that reference $_SERVER['PHP_SELF'].

Monitoring Recommendations

Alert on repeated 200 OK responses to unusual URIs beneath register_nodb.php that include encoded angle brackets or event handler keywords.
Correlate suspicious ZZCMS requests with subsequent authentication events or session token reuse from new IP addresses.
Monitor browser-reported Content Security Policy (CSP) violation reports if CSP is deployed on the ZZCMS origin.

How to Mitigate CVE-2025-1949

Immediate Actions Required

Restrict public access to /3/ucenter_api/code/register_nodb.php at the reverse proxy or WAF until a vendor patch is applied.
Set the HttpOnly and Secure flags on all ZZCMS session cookies to limit the impact of script execution.
Deploy a strict Content Security Policy that disallows inline scripts on ZZCMS pages.

Patch Information

At the time of this writing, no vendor advisory or official patch has been published in the NVD references for CVE-2025-1949. Administrators should track the VulDB entry #298541 and the ZZCMS project channels for a fixed release. Once available, apply the patch and audit any other scripts that emit $_SERVER['PHP_SELF'] without encoding.

Workarounds

Manually patch register_nodb.php to wrap all output of $_SERVER['PHP_SELF'] in htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8').
Alternatively, replace usage of $_SERVER['PHP_SELF'] with $_SERVER['SCRIPT_NAME'], which is not influenced by extra path information.
Add a WAF signature blocking requests where the URI path following register_nodb.php contains <, >, ", or ' characters.

bash

# Example nginx rule to block XSS payloads targeting the vulnerable endpoint
location ~* ^/3/ucenter_api/code/register_nodb\.php {
    if ($request_uri ~* "(<|%3C)script|onerror=|javascript:") {
        return 403;
    }
}