icret EasyImages SVG Image upload.php cross site scripting

The XSS vulnerability in icret EasyImages allows an attacker to inject arbitrary JavaScript code into the application's web pages. This can be exploited to steal user cookies, redirect users to malicious websites, or deface the website. Successful exploitation requires an attacker to control the 'File' argument within the /app/upload.php endpoint. The impact is amplified if the application handles sensitive user data or performs critical operations, as an attacker could leverage the injected script to gain unauthorized access or manipulate data. While the CVSS score is LOW, the potential for user compromise and website defacement remains a significant concern.

Websites and applications utilizing icret EasyImages versions 2.8.0 through 2.8.6 are at risk. This includes organizations using the component for image handling and potentially vulnerable to cross-site scripting attacks. Shared hosting environments where multiple users share the same server instance are particularly vulnerable, as a compromised user account could be used to exploit the vulnerability and impact other users.

• php: Examine /app/upload.php for unsanitized input handling of the 'File' parameter. Search for instances where user-supplied data is directly outputted to the HTML without proper encoding.

// Example of vulnerable code
<?php
  echo $_GET['File']; // Vulnerable to XSS
?>

• generic web: Use curl to test the /app/upload.php endpoint with a payload like <script>alert('XSS')</script> as the 'File' parameter. Check the response for the alert box.

curl 'http://your-easyimages-site/app/upload.php?File=<script>alert(\'XSS\')</script>'

• generic web: Review access and error logs for suspicious requests to /app/upload.php containing potentially malicious script tags.

1. 2025-11-19Disclosure

   disclosure

1. 已保留2025-11-19
2. 发布日期2025-11-19
3. 修改日期2025-11-20
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-13415 is to upgrade icret EasyImages to version 2.8.7 or later, which contains the fix for this vulnerability. If upgrading immediately is not feasible, consider implementing input validation and sanitization on the 'File' argument in /app/upload.php to prevent malicious script injection. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Review and restrict file upload permissions to prevent unauthorized file uploads. After upgrading, confirm the vulnerability is resolved by attempting to upload a file with a known malicious script payload and verifying that the script is not executed.