CVE-2025-64047 Overview
CVE-2025-64047 is a Cross-Site Scripting (XSS) vulnerability in OpenRapid RapidCMS version 1.3.1. The flaw resides in the /user/user-move.php endpoint, which fails to properly sanitize user-supplied input before reflecting it back in the response. Attackers can craft malicious URLs that, when clicked by authenticated administrators or users, execute arbitrary JavaScript in the victim's browser session. The vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Successful exploitation allows attackers to hijack sessions, steal authentication cookies, deface content, or redirect users to malicious sites through crafted requests to /user/user-move.php.
Affected Products
- OpenRapid RapidCMS 1.3.1
- Component: openrapid:rapidcms
- Vulnerable endpoint: /user/user-move.php
Discovery Timeline
- 2025-11-24 - CVE-2025-64047 published to NVD
- 2026-07-05 - Last updated in NVD database
Technical Details for CVE-2025-64047
Vulnerability Analysis
The vulnerability exists in the user management module of OpenRapid RapidCMS 1.3.1, specifically in the /user/user-move.php script. The endpoint accepts request parameters and reflects them in the rendered HTML response without proper output encoding or input validation. This allows attackers to inject arbitrary HTML and JavaScript payloads.
The attack requires user interaction, meaning a target must be enticed to click a crafted link or visit an attacker-controlled page. Because the flaw operates across a security boundary, the scope is changed, giving attackers access to resources beyond the vulnerable component. Confidentiality and integrity are both affected at a limited level.
Additional technical details and proof-of-concept material are available in the GitHub Gist PoC Code.
Root Cause
The root cause is missing input sanitization and output encoding in /user/user-move.php. The script embeds request parameters directly into the HTML response body without applying context-aware escaping such as htmlspecialchars() for HTML contexts or JavaScript-specific encoding for script contexts. This is a classic reflected XSS pattern in PHP applications.
Attack Vector
An unauthenticated remote attacker constructs a URL containing a JavaScript payload as a parameter to /user/user-move.php. The attacker delivers this URL to a victim via phishing email, malicious link, or social engineering. When the victim visits the URL while authenticated to the RapidCMS instance, the payload executes in the victim's browser under the origin of the CMS. Attackers can then exfiltrate session cookies, perform actions on behalf of the victim, or pivot to further compromise of administrative accounts.
See the GitHub Gist PoC Code for verified exploitation details.
Detection Methods for CVE-2025-64047
Indicators of Compromise
- HTTP requests to /user/user-move.php containing URL-encoded <script>, onerror=, onload=, or javascript: payloads in query parameters
- Unusual referrer headers pointing to external phishing domains preceding requests to /user/user-move.php
- Web server access logs showing repeated probing of the user-move.php endpoint with mutated parameters
Detection Strategies
- Deploy web application firewall (WAF) rules that detect reflected XSS payload patterns in requests targeting /user/user-move.php
- Enable HTTP request logging and inspect access logs for parameters containing HTML tags, event handlers, or JavaScript URI schemes
- Correlate outbound browser telemetry with inbound requests to identify sessions where injected scripts executed against CMS users
Monitoring Recommendations
- Monitor administrative user sessions for anomalous cookie access patterns and unexpected requests originating from client browsers
- Alert on Content Security Policy (CSP) violation reports referencing the RapidCMS origin
- Track access log volume spikes and error rates on /user/user-move.php for signs of automated fuzzing
How to Mitigate CVE-2025-64047
Immediate Actions Required
- Restrict access to the /user/user-move.php endpoint using authentication controls and IP allowlists where feasible
- Deploy a WAF with reflected XSS signatures in front of the RapidCMS application
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
- Educate administrators to avoid clicking untrusted links while authenticated to the CMS
Patch Information
At the time of publication, no official vendor advisory or patch has been listed for OpenRapid RapidCMS 1.3.1. Administrators should monitor the OpenRapid RapidCMS project repository for security updates and apply any released patches immediately.
Workarounds
- Apply virtual patching through WAF rules that filter HTML metacharacters and script payloads in requests to /user/user-move.php
- Configure the browser session with HttpOnly and Secure cookie flags to limit script-based cookie theft
- Consider disabling or removing the user-move functionality if it is not required for business operations
- Deploy a strict Content-Security-Policy header such as default-src 'self'; script-src 'self' to reduce payload execution
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
