Plataforma
php
Componente
zzz
Corrigido em
3403.0.1
CVE-2025-14722 describes a cross-site scripting (XSS) vulnerability discovered in vion707 DMadmin, affecting versions up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. Successful exploitation allows an attacker to inject malicious scripts into the application, potentially compromising user sessions and data. A fix is available in version 3403.0.1.
This XSS vulnerability allows an attacker to inject arbitrary JavaScript code into the DMadmin interface. An attacker could leverage this to steal user credentials, redirect users to malicious websites, or deface the application. The impact is amplified if DMadmin is used to manage sensitive data or control critical infrastructure, as an attacker could potentially gain unauthorized access and control. The publicly disclosed nature of the exploit increases the likelihood of exploitation, especially given the vendor's lack of response to the disclosure.
This vulnerability has been publicly disclosed, increasing the risk of exploitation. While the CVSS score is LOW (2.4), the public availability of the exploit makes it a significant concern. The vendor's lack of response to the disclosure further exacerbates the risk, suggesting that a patch may not be prioritized. There is no indication of this being added to the CISA KEV catalog or active exploitation campaigns at this time.
Organizations using vion707 DMadmin for managing their infrastructure or applications are at risk. This includes those relying on DMadmin for configuration management, monitoring, or other critical tasks. Shared hosting environments where multiple users share the same DMadmin instance are particularly vulnerable, as a compromise of one user could potentially affect others.
• php: Examine the Admin/Controller/AddonsController.class.php file for any unusual or unexpected code.
grep -r 'eval(' /path/to/DMadmin/Admin/Controller/• generic web: Monitor access logs for suspicious requests targeting the Add function with unusual parameters.
grep 'Admin/Controller/AddonsController.class.php' /var/log/apache2/access.log• generic web: Check response headers for signs of script injection.
curl -I <DMadmin_URL>/Admin/Controller/AddonsController.class.php | grep Content-TypePublic Disclosure
Status do Exploit
EPSS
0.04% (percentil 11%)
CISA SSVC
Vetor CVSS
The primary mitigation is to upgrade to version 3403.0.1 or later, which contains the fix for this vulnerability. If upgrading immediately is not possible, consider implementing temporary workarounds such as input validation and output encoding on the Add function within Admin/Controller/AddonsController.class.php. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a layer of protection. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload into the Add function and verifying that it is properly sanitized.
Actualice DMadmin a una versión posterior a 3403cafdb42537a648c30bf8cbc8148ec60437d1. Si no hay actualizaciones disponibles, revise y sanitize las entradas del usuario en el archivo Admin/Controller/AddonsController.class.php, función Add, para evitar la inyección de código malicioso.
Análise de vulnerabilidades e alertas críticos diretamente no seu e-mail.
CVE-2025-14722 is a cross-site scripting (XSS) vulnerability in vion707 DMadmin versions up to 3403cafdb42537a648c30bf8cbc8148ec60437d1, allowing attackers to inject malicious scripts.
You are affected if you are using vion707 DMadmin versions prior to 3403.0.1. Check your version and upgrade if necessary.
Upgrade to version 3403.0.1 or later. As a temporary workaround, implement input validation and output encoding.
While there's no confirmed active exploitation, the vulnerability is publicly disclosed, increasing the risk of exploitation.
Due to the vendor's lack of response, an official advisory may not be available. Monitor security news sources for updates.
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.