rawchen ecms Add New Product updateProductServlet.java updateProductServlet cross site scripting

An attacker can exploit this XSS vulnerability by manipulating the 'productName' argument in the updateProductServlet function. This allows them to inject arbitrary JavaScript code that will be executed in the context of the user's browser. Successful exploitation could result in the attacker stealing session cookies, redirecting users to malicious websites, or defacing the application. The impact is amplified if the application is used by privileged users, as the attacker could potentially gain access to sensitive data or perform administrative actions. Because the vulnerability is publicly disclosed, the risk of exploitation is elevated.

Organizations using rawchen ecms, particularly those with publicly accessible instances or those handling sensitive user data, are at risk. Shared hosting environments where multiple users share the same ecms instance are also particularly vulnerable, as an attacker could potentially exploit the vulnerability through another user's account.

• java / server:

find /var/log/ -name '*.log' -print0 | xargs -0 grep -i 'updateProductServlet'

• generic web:

curl -s -X POST 'http://your-ecms-instance/servlet/product/updateProductServlet' -d 'productName=<script>alert("XSS")</script>' | grep -i 'XSS'

1. 2025-12-28Disclosure

   disclosure

1. Gereserveerd2025-12-27
2. Gepubliceerd2025-12-28
3. Gewijzigd2025-12-29
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-15149 is to upgrade to rawchen ecms version 59.0.1 or later. Given the rolling release nature of the product, ensuring all instances are updated is critical. As a temporary workaround, input validation on the 'productName' field can be implemented to sanitize user-supplied data and prevent the injection of malicious scripts. This could involve restricting the allowed characters or escaping special characters. Web application firewalls (WAFs) configured to detect and block XSS attacks can also provide an additional layer of protection. Monitor application logs for suspicious activity, particularly related to the updateProductServlet endpoint.