CVE-2025-2352: Starsea-mall Backend XSS Vulnerability

CVE-2025-2352 Overview

CVE-2025-2352 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in StarSea99 starsea-mall 1.0. The flaw resides in the /admin/indexConfigs/save endpoint of the Backend component. Attackers can manipulate the categoryName parameter to inject arbitrary script content that executes in the browser context of users who view the affected admin page.

The vulnerability requires high privileges and user interaction, and can be triggered remotely across the network. The public disclosure notes that additional parameters may also be affected. The vendor was contacted before disclosure but did not respond, and the project does not maintain versioned releases.

Critical Impact
An authenticated attacker with backend access can inject persistent JavaScript into administrative pages, enabling session theft, admin action hijacking, and further compromise of the mall application.

Affected Products

StarSea99 starsea-mall 1.0.0
Backend component: /admin/indexConfigs/save
Product does not use versioning; other releases may also be impacted

Discovery Timeline

2025-03-16 - CVE-2025-2352 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2352

Vulnerability Analysis

The vulnerability is a stored cross-site scripting issue in the administrative backend of starsea-mall, an open-source e-commerce application. The /admin/indexConfigs/save handler accepts a categoryName value from the request and persists it without applying output encoding or input sanitization. When the stored value is later rendered in an admin view, the browser interprets injected markup as executable script.

Exploitation requires an authenticated backend session, which limits the attacker population to users who already hold administrative or elevated roles. The advisory notes that parameters beyond categoryName may share the same weakness, expanding the injection surface across the configuration endpoint.

Root Cause

The root cause is missing neutralization of user-supplied input during web page generation [CWE-79]. The backend save handler stores raw input and downstream views render it as HTML rather than encoding it as text, allowing <script> and event-handler payloads to execute.

Attack Vector

An authenticated attacker sends a crafted POST request to /admin/indexConfigs/save with a JavaScript payload in the categoryName field. The payload is stored server-side and executes when another privileged user loads the affected admin page. The impact is limited to the browser context but can be used to hijack sessions, perform CSRF-like admin actions, or pivot deeper into the application.

No verified proof-of-concept code is published in the referenced sources. See the VulDB CTI Alert #299819 and the GitHub starsea-mall repository for further technical context.

Detection Methods for CVE-2025-2352

Indicators of Compromise

POST requests to /admin/indexConfigs/save containing HTML tags, <script>, javascript:, or event handlers such as onerror= or onload= in the categoryName parameter
Stored configuration records where category name fields contain angle brackets or encoded script fragments
Unexpected outbound requests from admin browsers to attacker-controlled domains after loading index configuration pages

Detection Strategies

Inspect web server and application logs for requests to /admin/indexConfigs/save whose parameter values contain HTML metacharacters
Run database queries against the index configuration table to identify stored values containing <, >, script, or URL-encoded equivalents
Deploy web application firewall (WAF) rules that flag HTML and script tokens submitted to admin endpoints

Monitoring Recommendations

Alert on repeated 4xx/5xx responses from the admin backend that indicate probing of the configuration endpoints
Monitor administrative account activity for anomalous session creation, credential changes, or configuration edits following visits to index config pages
Enable Content Security Policy (CSP) violation reporting to surface script executions blocked in admin views

How to Mitigate CVE-2025-2352

Immediate Actions Required

Restrict network access to the starsea-mall admin interface using IP allowlists, VPN, or reverse-proxy authentication
Audit stored index configuration records and remove entries containing script or HTML payloads
Enforce strong authentication and role separation for all backend administrator accounts

Patch Information

No official vendor patch is available. The vendor did not respond to disclosure, and the project does not use versioning. Users should apply source-level fixes by adding server-side input validation on categoryName and related parameters, and by HTML-encoding all configuration values at render time. Track updates through the GitHub starsea-mall repository.

Workarounds

Apply a WAF rule that blocks HTML metacharacters and script keywords in POST bodies to /admin/indexConfigs/save
Set a strict Content Security Policy on admin pages that disables inline scripts and restricts script sources
Add server-side encoding using a library such as OWASP Java Encoder in the view layer before rendering stored configuration values
Limit administrative accounts to trusted personnel and rotate session cookies frequently

bash

# Example Nginx rule to block obvious XSS payloads on the vulnerable endpoint
location = /admin/indexConfigs/save {
    if ($request_method = POST) {
        if ($request_body ~* "(<script|javascript:|onerror=|onload=|<img|<svg)") {
            return 403;
        }
    }
    proxy_pass http://starsea_mall_backend;
}