CVE-2025-4379: DobryCMS Reflected XSS Vulnerability

CVE-2025-4379 Overview

CVE-2025-4379 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting DobryCMS versions 2.* and lower. The flaw resides in the szukaj (search) parameter, which fails to properly validate and sanitize user-supplied input. Attackers can craft a malicious URL containing JavaScript payloads that execute in a victim's browser when the link is opened. Successful exploitation requires user interaction, typically through phishing or a social engineering lure. The vendor released a hotfix on 29 April 2025 that removes the vulnerability without incrementing the product version. The issue is tracked under [CWE-79] and is documented by CERT.PL.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session token theft, credential harvesting, and content manipulation within the DobryCMS application context.

Affected Products

DobryCMS version 2.x
DobryCMS versions prior to 2.x
DobryCMS instances not patched with the 29 April 2025 hotfix

Discovery Timeline

2025-04-29 - Vendor releases hotfix for affected versions
2025-05-23 - CVE-2025-4379 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4379

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw ([CWE-79]) in the DobryCMS search functionality. The szukaj HTTP parameter accepts user input that is reflected directly into server responses without proper output encoding or input filtering. When a victim visits a crafted URL, the injected JavaScript executes in the context of the DobryCMS origin. This allows attackers to run scripts under the victim's authenticated session with the site.

Because the payload is delivered via URL, exploitation requires the victim to click a malicious link. Attackers typically distribute such links through phishing emails, instant messaging, or malicious advertising. The scope changes to affect a subsequent security zone (the browser), which explains the confidentiality and integrity impacts limited to the browser context rather than the underlying server. See the CERT.PL advisory for full analysis.

Root Cause

The root cause is improper neutralization of input during web page generation. The DobryCMS search handler embeds the raw szukaj parameter value into the rendered HTML response. No context-aware output encoding is applied before reflecting the input into the response body.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL of the form https://victim-site.example/?szukaj=<payload> where <payload> contains JavaScript such as an HTML script tag or event handler. When the victim opens the URL in a browser with an active DobryCMS session, the payload executes with the site's origin privileges. Common outcomes include cookie theft, forced browser actions on behalf of the user, and phishing content injection.

No verified public proof-of-concept code is available. Refer to the CERT.PL analysis for technical details.

Detection Methods for CVE-2025-4379

Indicators of Compromise

HTTP GET requests to DobryCMS endpoints containing szukaj= parameters with encoded or raw <script>, onerror=, onload=, or javascript: tokens
Referrer headers originating from phishing domains or suspicious external sources pointing to search URLs
Unusual outbound requests from user browsers to attacker-controlled domains shortly after visiting DobryCMS search URLs

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the szukaj query parameter for HTML tags, JavaScript event handlers, and URL-encoded script fragments
Review web server access logs for anomalous query strings containing scripting payloads or character sequences such as %3Cscript%3E and %3Cimg
Correlate reflected content in server responses with input parameters using DAST scanners against staging or production instances

Monitoring Recommendations

Enable Content Security Policy (CSP) violation reporting to capture blocked inline script execution attempts
Ingest web server, WAF, and browser telemetry into a centralized data lake for cross-source correlation of suspicious search traffic
Alert on user sessions where the same account exhibits rapid session token reuse from multiple geolocations, a possible indicator of stolen cookies

How to Mitigate CVE-2025-4379

Immediate Actions Required

Apply the DobryCMS hotfix released on 29 April 2025 to all affected instances, noting that the fix does not increment the product version string
Audit currently deployed DobryCMS installations to confirm the hotfix has been applied against the szukaj parameter handler
Rotate session cookies and administrative credentials if suspicious search-parameter traffic is observed in logs

Patch Information

The vendor released a hotfix on 29 April 2025 that eliminates the vulnerability in affected 2.x versions. The hotfix does not change the reported version number, so administrators must verify patch application at the file or configuration level rather than by version banner. Refer to the CERT.PL advisory and vendor communications for hotfix retrieval instructions.

Workarounds

Deploy a WAF rule to block or sanitize requests where the szukaj parameter contains HTML tags or JavaScript event attributes
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Set the HttpOnly and Secure flags on session cookies to limit the impact of stolen tokens via client-side JavaScript

bash

# Example ModSecurity rule to block script payloads in the szukaj parameter
SecRule ARGS:szukaj "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1004379,phase:2,deny,status:403,\
    msg:'CVE-2025-4379 DobryCMS Reflected XSS attempt in szukaj parameter'"