CVE-2025-3386: Pb-cms Cross Site Scripting Vulnerability

CVE-2025-3386 Overview

CVE-2025-3386 is a cross-site scripting (XSS) vulnerability [CWE-79] in LinZhaoguan pb-cms 2.0. The flaw resides in the Friendship Link Handler component, accessible through the /admin#links endpoint. An authenticated attacker can inject malicious script content that executes in the browser of any user viewing the affected page. The exploit has been publicly disclosed, increasing the risk of opportunistic abuse against exposed installations.

Critical Impact
Attackers with administrative privileges can inject persistent JavaScript payloads through the Friendship Link management interface, enabling session compromise, credential theft, and administrative action hijacking against pb-cms 2.0 deployments.

Affected Products

LinZhaoguan pb-cms 2.0
Component: Friendship Link Handler (/admin#links)
CPE: cpe:2.3:a:pb-cms_project:pb-cms:2.0:*:*:*:*:*:*:*

Discovery Timeline

2025-04-07 - CVE-2025-3386 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3386

Vulnerability Analysis

The vulnerability affects the Friendship Link Handler in the administrative interface of pb-cms 2.0. The application fails to sanitize or encode user-supplied input submitted through the /admin#links functionality. When another user or administrator loads the links management view, the injected payload executes in the context of the pb-cms origin.

Exploitation requires high privileges combined with user interaction, which limits mass exploitation. However, attackers who compromise a low-tier admin account can escalate their reach by targeting higher-privileged users viewing the manipulated content. The scope remains bounded to the application itself, with no direct impact on host confidentiality or availability.

Root Cause

The root cause is improper neutralization of input during web page generation, classified under [CWE-79]. The Friendship Link handler stores attacker-controlled data and reflects it into rendered HTML without applying context-appropriate output encoding. Any HTML or JavaScript submitted through the affected fields is treated as executable markup when rendered.

Attack Vector

The attack originates over the network against the administrative panel. An attacker with authenticated administrative access submits a crafted friendship link entry containing JavaScript. When a legitimate user navigates to /admin#links, the browser parses and executes the stored payload. Typical outcomes include theft of session cookies, forced administrative actions via CSRF, and injection of secondary payloads such as keyloggers or credential harvesters targeting the admin UI.

No verified proof-of-concept code is published in referenced sources. Technical discussion is available in the Gitee Issue Discussion and the VulDB advisory.

Detection Methods for CVE-2025-3386

Indicators of Compromise

Friendship link records containing HTML tags such as <script>, <img onerror=>, or javascript: URI schemes stored in the pb-cms database.
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains following visits to /admin#links.
Anomalous administrative actions performed from valid admin sessions shortly after accessing the links management view.

Detection Strategies

Inspect pb-cms database tables that persist friendship link entries for angle brackets, event handler attributes, and encoded script fragments.
Deploy web application firewall rules that inspect POST bodies to /admin link endpoints for XSS signatures.
Correlate administrator authentication events with subsequent DOM-based script execution telemetry from browser isolation or endpoint agents.

Monitoring Recommendations

Enable HTTP access logging for all /admin routes and forward logs to a centralized analytics platform for retention and query.
Monitor Content Security Policy (CSP) violation reports if CSP is enforced on the admin interface.
Alert on any modification to friendship link records outside of scheduled maintenance windows.

How to Mitigate CVE-2025-3386

Immediate Actions Required

Restrict access to the pb-cms administrative interface using network segmentation, VPN, or IP allowlisting until a patched release is available.
Audit all existing friendship link entries and remove any records containing HTML or scripting constructs.
Rotate administrator credentials and invalidate active sessions if suspicious link entries are discovered.

Patch Information

No vendor security advisory or patched release is listed in the referenced sources at the time of publication. Monitor the Gitee Issue Discussion for upstream remediation status and apply any vendor-supplied update as soon as it becomes available.

Workarounds

Deploy a reverse proxy or web application firewall in front of pb-cms to strip or encode HTML metacharacters submitted to the links endpoint.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Limit the number of accounts with administrative privileges and require multi-factor authentication for all admin logins.

bash

# Example nginx CSP header for pb-cms admin interface
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;