Nakiami Mellivora Admin Panel user.inc.php print_user_ip_log cross site scripting

The vulnerability lies within the printuserip_log function of the user.inc.php file within the Admin Panel component. An attacker can manipulate the $entry['ip'] argument to inject arbitrary JavaScript code. Successful exploitation allows the attacker to execute malicious scripts within the context of the user's browser, potentially stealing session cookies, redirecting users to malicious websites, or modifying the application's content. The impact is amplified if the application is used in a sensitive environment or handles confidential data, as an attacker could gain unauthorized access and compromise user accounts.

Organizations using Mellivora versions 2.0 and 2.1, particularly those with publicly accessible Admin Panels, are at risk. Shared hosting environments where multiple users share the same Mellivora installation are also at increased risk, as a compromised user account could be used to launch attacks against other users.

• php: Examine the user.inc.php file for the vulnerable printuserip_log function. Search for instances where the $entry['ip'] variable is directly outputted without proper sanitization.

// Example of vulnerable code
echo "User IP: " . $entry['ip'];

• generic web: Monitor access logs for suspicious requests targeting the Admin Panel, particularly those containing unusual characters or JavaScript code in the user IP field. Use a WAF to block requests containing potentially malicious JavaScript payloads. • generic web: Check response headers for signs of XSS, such as the presence of injected JavaScript code in the HTML content.

1. 2019-07-16Discovery

   discovery

2. 2022-12-28Disclosure

   disclosure

1. Reserviert2022-12-28
2. Veröffentlicht2022-12-28
3. Geändert2025-04-11
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2019-25092 is to upgrade Mellivora to version 2.2.0, which includes a patch (commit e0b6965f8dde608a3d2621617c05695eb406cbb9) addressing the vulnerability. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the $entry['ip'] parameter to prevent malicious code injection. Web application firewalls (WAFs) can also be configured to detect and block XSS attempts targeting this specific function. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into the user IP log field and verifying that it is properly sanitized.