CVE-2025-52035: Exe-system Notescms XSS Vulnerability

CVE-2025-52035 Overview

CVE-2025-52035 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in NotesCMS, an open-source content management system developed by exe-system. The flaw resides in the /index.php?route=notes endpoint, where the title field of service descriptions fails to properly sanitize user-supplied input. Attackers can inject malicious JavaScript payloads that execute in the browser context of any user who views the affected page. The issue was confirmed in commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 and remediated in commit 95322c5121dbd7070f3bd54f2848079654a0a8ea. Exploitation requires user interaction and can be launched remotely without authentication.

Critical Impact
Attackers can hijack sessions, steal credentials, and perform actions on behalf of authenticated users through injected JavaScript stored in service description titles.

Affected Products

NotesCMS versions containing commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (dated 2024-05-08)
All NotesCMS builds prior to fix commit 95322c5121dbd7070f3bd54f2848079654a0a8ea (dated 2025-03-31)
Exe-system NotesCMS deployments exposing the /index.php?route=notes endpoint

Discovery Timeline

2025-08-26 - CVE-2025-52035 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52035

Vulnerability Analysis

The vulnerability is a stored XSS flaw affecting the notes management functionality in NotesCMS. When a user creates or modifies a service description, the application accepts the title parameter and persists it to the backing datastore without applying output encoding or input sanitization. When another user later loads /index.php?route=notes, the stored title is rendered directly into the HTML response, causing any embedded script to execute in the victim's browser.

Because the payload is persistent, every visitor to the affected page becomes a target until the malicious record is removed. The attack requires user interaction to view the page but does not require authentication to store the payload if the notes creation endpoint is exposed. The scope change indicates that an exploit can affect resources beyond the vulnerable component, such as tokens or cookies from other origins loaded in the same browsing context.

Root Cause

The root cause is the absence of contextual output encoding when rendering the title field of service descriptions. The application trusts stored input as safe HTML and inserts it into the DOM without escaping characters such as <, >, and ". This aligns with [CWE-79]: Improper Neutralization of Input During Web Page Generation.

Attack Vector

An attacker submits a note with a title field containing an HTML or JavaScript payload through the notes creation workflow. The payload persists in the database. When a victim navigates to /index.php?route=notes, the browser parses the injected markup and executes the attacker's script under the origin of the NotesCMS application. Typical outcomes include session cookie theft, credential harvesting through injected forms, and unauthorized state-changing requests initiated on behalf of the victim.

See the GitHub Gist Code Snippet and the GitHub Issue Discussion for reference details from the reporter.

Detection Methods for CVE-2025-52035

Indicators of Compromise

HTTP POST requests to /index.php?route=notes containing <script>, onerror=, onload=, or javascript: sequences in the title parameter
Stored records in the NotesCMS database whose service description titles contain HTML tags or JavaScript event handlers
Anomalous outbound requests from user browsers to attacker-controlled domains shortly after visiting the notes page

Detection Strategies

Inspect application logs and database records for note titles containing angle brackets, event handler attributes, or encoded script fragments
Deploy web application firewall rules that flag XSS patterns in requests targeting the route=notes endpoint
Enable Content Security Policy (CSP) reporting to identify script executions from inline or unexpected sources

Monitoring Recommendations

Monitor for repeated modifications to the notes table originating from a single account or IP address
Alert on outbound connections from user sessions to newly registered or low-reputation domains referenced in note content
Review access logs for unauthenticated writes to the notes creation endpoint

How to Mitigate CVE-2025-52035

Immediate Actions Required

Update NotesCMS to a build that includes commit 95322c5121dbd7070f3bd54f2848079654a0a8ea or later
Audit the notes datastore for records containing HTML or JavaScript in the title field and purge malicious entries
Restrict access to the NotesCMS administrative interface to trusted networks until patching is complete

Patch Information

The maintainers addressed the vulnerability in commit 95322c5121dbd7070f3bd54f2848079654a0a8ea, dated 2025-03-31. Administrators should pull the latest source from the upstream repository and redeploy. Refer to the GitHub Issue Discussion for maintainer confirmation of the fix.

Workarounds

Apply a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Deploy a reverse proxy or WAF rule that strips or blocks HTML tags in the title parameter submitted to /index.php?route=notes
Temporarily disable public write access to the notes creation endpoint until the patch is applied

bash

# Example nginx rule to block script tags in the title parameter
location /index.php {
    if ($args ~* "route=notes.*title=.*(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
}