CVE-2025-47204: Bootstrap Multiselect XSS Vulnerability

CVE-2025-47204 Overview

CVE-2025-47204 affects post.php in the bootstrap-multiselect library (also known as Bootstrap Multiselect) version 1.1.2. The sample PHP script echoes arbitrary POST data directly to the response. Developers who reuse this sample structure in production applications introduce a Reflective Cross-Site Scripting (XSS) vulnerability. Attackers can trigger the flaw through Cross-Site Request Forgery (CSRF), causing a victim's browser to submit crafted POST data that reflects attacker-controlled script into the response. The issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
A successful attack executes attacker-controlled JavaScript in the victim's browser session, enabling session token theft, credential harvesting, and unauthorized actions in the context of the affected web application.

Affected Products

Davidstutz Bootstrap Multiselect 1.1.2 (post.php sample script)
Applications that reuse the post.php sample code without modification
Web deployments serving the vulnerable script on network-reachable endpoints

Discovery Timeline

2025-05-13 - CVE-2025-47204 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47204

Vulnerability Analysis

The vulnerability resides in post.php, a demonstration script bundled with bootstrap-multiselect 1.1.2. The script echoes POST parameters back to the caller without sanitization or output encoding. When a developer adopts this pattern in a live application, any HTML or JavaScript submitted in the POST body is reflected verbatim into the HTTP response.

Because the endpoint accepts state-changing requests without CSRF protection, an attacker can host a malicious page that auto-submits a form to the vulnerable endpoint. The victim's browser sends the request with attacker-controlled payloads, and the response executes the injected script in the origin of the vulnerable site.

Root Cause

The root cause is twofold. First, post.php performs unsanitized output of user-controlled POST data, producing a Reflected XSS primitive. Second, the endpoint lacks CSRF tokens or SameSite cookie enforcement, allowing cross-origin form submissions to reach the reflection sink. The combination transforms a sample debugging script into an exploitable client-side injection vector.

Attack Vector

Exploitation requires user interaction: the victim must load an attacker-controlled page while authenticated to, or browsing, the vulnerable application. The attacker's page issues an auto-submitting POST form or fetch request targeting the vulnerable post.php endpoint with a payload such as a <script> tag or event handler. The server reflects the payload, and the browser renders and executes it under the vulnerable site's origin. The scope change reflected in the CVSS vector indicates the impact extends beyond the vulnerable component to affect user session data in the browser.

No verified public proof-of-concept code is available. Consult the project release notes and the Nuclei template commit for detection details.

Detection Methods for CVE-2025-47204

Indicators of Compromise

HTTP POST requests to post.php containing HTML entities, <script> tags, or JavaScript event handlers such as onerror= and onload= in parameter values.
HTTP Referer headers pointing to external, unrelated domains when requests reach post.php.
Reflected response bodies from post.php that contain unescaped <, >, or quote characters matching the request payload.

Detection Strategies

Deploy the ProjectDiscovery Nuclei template associated with this CVE to scan public-facing web assets for the vulnerable post.php pattern.
Inventory web servers for the presence of bootstrap-multiselect version 1.1.2, particularly the post.php demonstration file, using file integrity monitoring or source code scanning.
Configure a web application firewall (WAF) to flag POST requests containing common XSS payloads reflected in subsequent responses.

Monitoring Recommendations

Alert on anomalous POST traffic to sample or demo endpoints under third-party library directories.
Monitor Content Security Policy (CSP) violation reports for inline script executions on pages that should not contain dynamic scripts.
Correlate cross-origin form submissions with authenticated session activity to identify CSRF-driven exploitation attempts.

How to Mitigate CVE-2025-47204

Immediate Actions Required

Remove the post.php sample file from production web roots if it was copied from the bootstrap-multiselect repository.
Audit application source trees for any handler that echoes $_POST, $_GET, or $_REQUEST data without sanitization.
Implement CSRF tokens on all state-changing endpoints and enforce SameSite=Lax or SameSite=Strict cookie attributes.

Patch Information

No dedicated patch has been published for post.php because the file is a demonstration artifact rather than production code. Review upstream guidance in the Bootstrap Multiselect release notes and remove or rewrite the sample handler. Application owners must apply output encoding and CSRF protections in their own code.

Workarounds

Replace unsanitized echo statements with context-aware output encoding such as htmlspecialchars($input, ENT_QUOTES, 'UTF-8').
Restrict access to sample scripts via web server configuration, blocking requests to post.php at the reverse proxy or .htaccess layer.
Deploy a strict Content Security Policy that disallows inline scripts and unsafe evaluation to reduce XSS impact.

bash

# Apache configuration to deny access to the vulnerable sample script
<Files "post.php">
    Require all denied
</Files>

# Nginx equivalent
location ~ /bootstrap-multiselect/.*/post\.php$ {
    deny all;
    return 403;
}