CVE-2025-25990: Hoosk CMS XSS Vulnerability

CVE-2025-25990 Overview

CVE-2025-25990 is a reflected Cross-Site Scripting (XSS) vulnerability affecting Hoosk CMS version 1.7.1. The flaw resides in the /install/index.php component, where user-supplied input is rendered back to the browser without proper sanitization or output encoding. A remote attacker can craft a malicious URL that, when visited by a target, executes attacker-controlled JavaScript in the victim's browser context. Successful exploitation allows attackers to obtain sensitive information such as session tokens, cookies, or credentials entered on the installation page. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser through a crafted link to the Hoosk installer, leading to information disclosure and session compromise.

Affected Products

Hoosk CMS version 1.7.1
Deployments exposing the /install/index.php component
Web applications using unpatched Hoosk builds from the havok89/Hoosk repository

Discovery Timeline

2025-02-14 - CVE-2025-25990 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25990

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the Hoosk CMS installation script located at /install/index.php. The script processes request parameters and echoes them back into the HTML response without applying context-appropriate encoding or input validation. An attacker crafts a URL containing JavaScript payload data in a vulnerable parameter and delivers it to a victim through phishing, forum posts, or malicious redirects. When the victim's browser loads the response, the injected script executes under the origin of the Hoosk site. Because the installer page frequently runs before authentication and hardening controls are in place, the exposure is particularly relevant for freshly deployed or misconfigured instances that leave /install/ reachable after setup. Refer to the GitHub Issue Discussion for additional technical context.

Root Cause

The root cause is missing output encoding and input sanitization in /install/index.php. Parameter values flow directly into the HTML template, allowing <script> tags and event handlers to be interpreted as executable markup rather than data.

Attack Vector

Exploitation requires user interaction. The attacker delivers a crafted URL pointing at a vulnerable Hoosk instance. When the victim clicks the link, the browser renders the reflected payload and executes it in the site's origin, giving the attacker access to cookies, DOM content, and any data submitted on the page.

No verified proof-of-concept code is published. See the referenced GitHub issue for reported behavior.

Detection Methods for CVE-2025-25990

Indicators of Compromise

Web server access logs showing requests to /install/index.php containing URL-encoded <script>, javascript:, or onerror= fragments
Unusual referrers directing users to the /install/ path on production Hoosk sites
Reports from users of unexpected pop-ups, redirects, or credential prompts when visiting Hoosk pages

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects query strings on /install/index.php for HTML tag characters and common XSS payload patterns
Perform authenticated and unauthenticated scans of Hoosk deployments using DAST tools configured for reflected XSS detection
Review source code and static analysis reports for unescaped output of $_GET and $_POST values within installer scripts

Monitoring Recommendations

Alert on any HTTP request to /install/ on production Hoosk hosts, since the installer should be removed after setup
Monitor Content Security Policy (CSP) violation reports for inline script executions originating from Hoosk pages
Track outbound requests from client browsers to unfamiliar domains immediately after visits to Hoosk URLs, which may indicate data exfiltration

How to Mitigate CVE-2025-25990

Immediate Actions Required

Delete or restrict access to the /install/ directory on all production Hoosk deployments
Apply HTML output encoding to all user-controlled parameters rendered by installer scripts
Enforce a strict Content Security Policy that disallows inline scripts and unauthorized script sources
Educate users and administrators to avoid clicking untrusted links pointing at Hoosk installations

Patch Information

No official vendor patch is referenced in the NVD entry. Track remediation progress through the upstream project at the havok89/Hoosk GitHub repository. Until a fix is released, treat the installer path as untrusted and remove it from network-reachable locations.

Workarounds

Remove /install/index.php and the entire /install/ directory after Hoosk setup completes
Add a web server rule that returns HTTP 404 or 403 for any request to the installer path
Filter query parameters at the reverse proxy layer to block requests containing HTML tag characters targeting installer endpoints

bash

# Example nginx configuration to block access to the Hoosk installer
location ^~ /install/ {
    deny all;
    return 404;
}