CVE-2025-70958: Subrion CMS XSS Vulnerability

CVE-2025-70958 Overview

CVE-2025-70958 affects Subrion CMS v4.2.1, an open-source content management system developed by Intelliants. The installation module contains multiple reflected cross-site scripting (XSS) vulnerabilities [CWE-79]. Attackers can inject crafted JavaScript payloads through the dbuser, dbpwd, and dbname parameters. The payloads execute in the victim's browser context after the user follows a malicious link.

Critical Impact

Attackers can execute arbitrary JavaScript in the victim's browser, enabling session hijacking, credential theft, and malicious actions performed under the target user's identity.

Affected Products

• Intelliants Subrion CMS 4.2.1
• Installation module endpoints accepting dbuser, dbpwd, and dbname parameters
• Deployments where the installation script remains accessible post-setup

Discovery Timeline

• 2026-02-02 - CVE-2025-70958 published to NVD
• 2026-02-11 - Last updated in NVD database

Technical Details for CVE-2025-70958

Vulnerability Analysis

The vulnerability resides in the Subrion CMS v4.2.1 installation workflow. The installer accepts database configuration values through HTTP request parameters and reflects those values back into the rendered HTML response without proper output encoding. An attacker who crafts a URL containing JavaScript in the dbuser, dbpwd, or dbname parameters can trigger script execution when a victim loads the page.

Because this is a reflected XSS issue, exploitation requires user interaction. The attacker delivers the malicious link through phishing, chat platforms, or other social engineering channels. Once the victim opens the link, the injected payload runs with the privileges of the user's browser session against the Subrion CMS domain.

The attack changes scope from the vulnerable component to the user's browser security context, allowing access to cookies, session tokens, and same-origin resources. Successful exploitation enables credential theft, defacement of rendered pages, and forced actions inside an authenticated administrator session if one is active.

Root Cause

The root cause is missing input validation and output sanitization in the installation module. User-supplied values for the dbuser, dbpwd, and dbname parameters are inserted directly into HTML responses without HTML entity encoding or contextual escaping.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker constructs a URL targeting the installation script with JavaScript payloads in the affected parameters. Installations that leave the install module accessible after initial setup remain vulnerable to drive-by exploitation through crafted links. Technical proof-of-concept details are published in the GitHub Subrion CMS Exploit repository.

Detection Methods for CVE-2025-70958

Indicators of Compromise

• HTTP requests to Subrion CMS installation endpoints containing <script>, onerror=, or javascript: tokens in the dbuser, dbpwd, or dbname parameters
• Server access logs showing repeated GET or POST requests to the installer after initial site setup
• Outbound requests from browsers to attacker-controlled domains immediately following clicks on Subrion CMS URLs

Detection Strategies

• Inspect web server logs for URL-encoded XSS payloads targeting installer parameters
• Deploy Web Application Firewall (WAF) signatures for reflected XSS patterns on Subrion CMS paths
• Use static analysis on Subrion CMS deployments to confirm whether installer files remain web-accessible

Monitoring Recommendations

• Alert on any HTTP traffic reaching the installation module after initial deployment completes
• Monitor for anomalous JavaScript execution in browser telemetry on pages served by Subrion CMS
• Correlate phishing email indicators with inbound clicks targeting Subrion CMS hosts

How to Mitigate CVE-2025-70958

Immediate Actions Required

• Remove or restrict access to the Subrion CMS installation directory on all production deployments
• Block external HTTP access to installer endpoints at the reverse proxy or WAF layer
• Audit existing Subrion CMS v4.2.1 installations and confirm setup files are deleted post-installation

Patch Information

No vendor advisory or patch is referenced in the available CVE data. Subrion CMS v4.2.1 is the affected version. Operators should evaluate whether to continue using this codebase given the public exploit details available in the GitHub Subrion CMS Exploit repository.

Workarounds

• Delete the install/ directory from the web root after initial setup completes
• Apply WAF rules that strip or block HTML and JavaScript metacharacters in dbuser, dbpwd, and dbname parameters
• Implement a strict Content Security Policy (CSP) that disallows inline script execution on Subrion CMS domains
• Educate administrators to avoid clicking unverified links pointing to CMS administrative or installation paths

# Configuration example: remove installer and restrict access via nginx
rm -rf /var/www/subrion/install/

# nginx location block to deny any residual installer access
location ~* ^/install/ {
    deny all;
    return 404;
}