dayrui XunRuiCMS Add Data Validation admind45f74adbd95.php cross site scripting

An attacker can exploit this XSS vulnerability by crafting a malicious URL containing a specially crafted data[name] parameter. When a user visits this URL, the injected script will execute in their browser context, allowing the attacker to steal cookies, redirect the user to a phishing site, or modify the content of the page. The impact can range from minor annoyance to significant data compromise, depending on the attacker's goals and the user's privileges. Given the remote accessibility of the vulnerability, it presents a broad attack surface. The public disclosure increases the likelihood of exploitation by both automated scanners and targeted attackers.

Organizations and individuals using XunRuiCMS versions 4.7.0 through 4.7.1 are at risk. Shared hosting environments where multiple users share the same XunRuiCMS installation are particularly vulnerable, as an attacker could potentially compromise other users' accounts through this XSS vulnerability. Legacy configurations that haven't been regularly updated are also at increased risk.

• php / web server:

grep -r 'data[name]=[^>]*script' /var/www/html/admind45f74adbd95.php

• web server:

curl -s 'http://your-xunruicms-site.com/admind45f74adbd95.php?c=field&m=add&rname=site&rid=1&page=1&data[name]=<script>alert("XSS")</script>' | grep 'alert("XSS")'

• generic web: Inspect web server access logs for requests to /admind45f74adbd95.php containing suspicious characters or patterns in the data[name] parameter, such as <script> or javascript:.

1. 2025-12-04Disclosure

   disclosure

1. Gereserveerd2025-12-04
2. Gepubliceerd2025-12-04
3. Gewijzigd2026-02-24
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-14006 is to upgrade XunRuiCMS to a version that includes a fix for this vulnerability. Unfortunately, a specific fixed version is not provided in the available data. Until a patched version is released, consider implementing temporary workarounds such as input validation and output encoding on the data[name] parameter within the /admind45f74adbd95.php endpoint. Web application firewalls (WAFs) can also be configured to block requests containing suspicious characters in the data[name] parameter. Monitor web server access logs for unusual activity or attempts to exploit the vulnerability. After applying any mitigation, verify its effectiveness by attempting to inject a simple XSS payload and confirming that it is properly neutralized.