CVE-2025-5013: Hkcms XSS Vulnerability in Search Module

CVE-2025-5013 Overview

CVE-2025-5013 is a reflected cross-site scripting (XSS) vulnerability in HkCms up to version 2.3.2.240702. The flaw resides in the Search component, specifically in the /index.php/search/index.html endpoint, where the keyword parameter is not properly sanitized before being reflected in server responses. An unauthenticated remote attacker can craft a malicious URL containing JavaScript payloads in the keyword argument. When a user opens the link, the injected script executes in the browser under the origin of the vulnerable HkCms site. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in victim browsers, enabling session theft, credential harvesting, and defacement of the HkCms application context.

Affected Products

HkCms versions up to and including 2.3.2.240702
HkCms Search component (/index.php/search/index.html)
Deployments exposing the keyword search parameter to untrusted input

Discovery Timeline

2025-05-21 - CVE-2025-5013 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5013

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw categorized as [CWE-79] (Improper Neutralization of Input During Web Page Generation). HkCms accepts the keyword query parameter through the search endpoint and returns it directly in the rendered response without HTML entity encoding or context-aware output escaping. Attackers can embed HTML tags, event handlers, or <script> blocks in the parameter value. The malicious payload runs in the victim browser with full access to cookies, local storage, and the DOM of the HkCms site. Because the injection is reflected rather than stored, exploitation requires user interaction, typically through a crafted link delivered via phishing, forum posts, or search engine poisoning. The EPSS probability stands at 0.562% as of 2026-07-07.

Root Cause

The root cause is missing output encoding of user-controlled input within the search results template. The keyword parameter flows from the HTTP request into the response body without passing through an HTML-escaping routine. Framework-level protections such as templating auto-escape are either disabled or bypassed for this parameter.

Attack Vector

An attacker constructs a URL targeting /index.php/search/index.html with a keyword value containing script content. The attacker distributes the link to authenticated HkCms users or administrators. When the target loads the link, the browser executes the payload, allowing the attacker to steal session cookies, perform actions on behalf of the user, or redirect victims to attacker-controlled infrastructure. Refer to the Gitee Issue Report for technical details on the injection point.

Detection Methods for CVE-2025-5013

Indicators of Compromise

HTTP requests to /index.php/search/index.html containing keyword values with <script>, onerror=, onload=, or javascript: substrings
Referrer logs showing external sites linking to the search endpoint with encoded HTML entities in the query string
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after visiting the HkCms site

Detection Strategies

Deploy web application firewall rules that inspect the keyword parameter for reflected XSS patterns and block requests containing HTML tags or JavaScript keywords
Enable server-side request logging with full query string capture on the HkCms search route to support retrospective hunts
Correlate access logs with browser telemetry to identify sessions where reflected payloads were rendered

Monitoring Recommendations

Alert on repeated 200 responses from /index.php/search/index.html where the query string exceeds a benign length threshold
Monitor for URL-encoded angle brackets (%3C, %3E) and event handler patterns in web access logs
Track referrer patterns from external social media, email gateways, or link shorteners pointing to the search endpoint

How to Mitigate CVE-2025-5013

Immediate Actions Required

Restrict public access to the HkCms search endpoint through a reverse proxy or WAF filter until a vendor patch is applied
Review the Gitee Issue Report and the VulDB entry #309729 for vendor guidance
Invalidate active administrator sessions and rotate any credentials that may have been exposed through phishing campaigns leveraging this flaw

Patch Information

At the time of last NVD update on 2026-06-17, no fixed version beyond HkCms 2.3.2.240702 is referenced in the advisory. Operators should monitor the HkCms Gitee repository for an official security release and apply updates immediately upon availability.

Workarounds

Configure a WAF rule to reject requests to /index.php/search/index.html where the keyword parameter contains <, >, or javascript: tokens
Deploy a strict Content Security Policy (CSP) that disallows inline scripts to limit the impact of reflected payloads
Set the HttpOnly and Secure flags on session cookies to reduce the risk of cookie theft through XSS

bash

# Example ModSecurity rule to block reflected XSS on the HkCms search endpoint
SecRule REQUEST_URI "@beginsWith /index.php/search/index.html" \
    "chain,phase:2,deny,status:403,id:1005013,msg:'CVE-2025-5013 HkCms XSS attempt'"
    SecRule ARGS:keyword "@rx (?i)(<script|onerror=|onload=|javascript:)" \
        "t:none,t:urlDecodeUni"