CVE-2025-44115: Cotonti Siena XSS Vulnerability

CVE-2025-44115 Overview

CVE-2025-44115 is a stored cross-site scripting (XSS) vulnerability in Cotonti Siena version 0.9.25, an open-source content management system. The flaw resides in the administrative configuration endpoint /admin.php?m=config&n=edit&o=core&p=title, where the title parameter is not properly sanitized before being rendered. An authenticated administrator can inject JavaScript that executes in the browser of any user viewing pages that render the site title. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in victim browsers, enabling session hijacking, credential theft, and administrative action forgery within the Cotonti Siena admin interface.

Affected Products

Cotonti Siena 0.9.25
CMS deployments exposing the core configuration editor to authenticated users
Sites where the site title value is rendered in headers, page templates, or emails without additional encoding

Discovery Timeline

2025-06-02 - CVE-2025-44115 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-44115

Vulnerability Analysis

Cotonti Siena exposes a core configuration editor at /admin.php?m=config&n=edit&o=core&p=title that lets administrators set the site title value. The application stores user-supplied input for the title field and later renders it in HTML contexts without sufficient output encoding. An attacker who controls or compromises an administrator account can inject a JavaScript payload into the title parameter. The payload persists in the site configuration and executes whenever any user loads a page that outputs the site title.

Because the injected script runs in the authenticated context of visiting administrators, it can perform any action they are authorized to perform. The stored nature of the injection increases blast radius compared to reflected XSS, since exploitation does not require a crafted URL for each victim.

Root Cause

The root cause is missing or insufficient contextual output encoding when the title configuration value is written into HTML templates. Cotonti Siena accepts arbitrary characters in the title field without stripping or escaping HTML control characters such as <, >, ", and '. When the value is later interpolated into a template, the browser parses the injected markup as executable script rather than literal text.

Attack Vector

Exploitation requires network access to the admin interface, low-privilege authentication as an account permitted to edit core configuration, and user interaction from a subsequent visitor whose browser renders the poisoned title. The attacker submits a POST request to /admin.php?m=config&n=edit&o=core&p=title containing a JavaScript payload in the title parameter. Any subsequent page that echoes the site title triggers execution.

For technical details and proof-of-concept material, see the GitHub Gist PoC Code and the upstream GitHub Issue #1834 Discussion.

Detection Methods for CVE-2025-44115

Indicators of Compromise

Unexpected HTML tags, <script> elements, or event handlers such as onerror= present in the stored site title configuration value.
Web server access logs showing POST requests to /admin.php?m=config&n=edit&o=core&p=title from unusual source IPs or outside normal administrative hours.
Outbound requests from browsers of admin users to attacker-controlled domains shortly after loading Cotonti-hosted pages.

Detection Strategies

Inspect the Cotonti configuration table for the title entry and validate that its content contains only expected plain-text characters.
Alert on HTTP requests to the core configuration editor endpoint containing angle brackets, javascript:, or common XSS payload signatures.
Compare rendered page HTML against a known-good baseline to identify script content injected via configuration values.

Monitoring Recommendations

Enable and centralize web application access logging for all admin.php requests, retaining source IP, user identifier, and request body length.
Monitor administrator authentication events for anomalous logins that precede modifications to the site title value.
Deploy a Content Security Policy (CSP) reporting endpoint to receive violations when injected script attempts to execute in visitor browsers.

How to Mitigate CVE-2025-44115

Immediate Actions Required

Audit the current site title configuration value in Cotonti Siena and remove any HTML or JavaScript content.
Restrict access to /admin.php to trusted administrative networks using firewall or reverse-proxy allowlists.
Rotate credentials and session tokens for administrator accounts that may have viewed a poisoned title.
Review administrative account inventory and remove unused or excessive privileges to reduce the population of accounts able to reach the vulnerable endpoint.

Patch Information

As of the last NVD update, no vendor patch reference is listed in the advisory for Cotonti Siena 0.9.25. Track the upstream project via GitHub Issue #1650 Discussion and GitHub Issue #1834 Discussion for remediation status, and upgrade to a fixed release once available.

Workarounds

Apply a web application firewall (WAF) rule that blocks requests to /admin.php?m=config&n=edit&o=core&p=title containing angle brackets or common XSS keywords.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to a trusted allowlist.
Manually patch the template that renders the site title to apply HTML entity encoding using Cotonti's built-in escaping helper before output.
Require multi-factor authentication for all administrator accounts to reduce the likelihood of unauthorized configuration changes.

bash

# Example WAF rule (ModSecurity) blocking XSS payloads on the vulnerable endpoint
SecRule REQUEST_URI "@contains /admin.php" \
  "chain,phase:2,deny,status:403,id:1004411,msg:'CVE-2025-44115 XSS attempt on Cotonti title config'"
  SecRule ARGS:title "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none,t:urlDecodeUni"