修复版本
1.0.1
CVE-2025-3788 is a cross-site scripting (XSS) vulnerability affecting baseweb JSite versions 1.0 through 1.0. This vulnerability allows an attacker to inject malicious scripts into the application, potentially compromising user sessions and data. The vulnerability resides in the /a/sys/user/save file, specifically in how it handles the 'Name' argument. A patch is available in version 1.0.1.
Successful exploitation of CVE-2025-3788 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to a variety of malicious actions, including session hijacking, credential theft, and defacement of the website. The attacker could potentially steal sensitive user data, redirect users to malicious websites, or inject malware. Given the nature of XSS vulnerabilities, the impact can be significant, especially if the application handles sensitive information or is used by a large number of users.
This vulnerability has been publicly disclosed, increasing the likelihood of exploitation. While the CVSS score is LOW, the ease of exploitation and potential impact warrant attention. No known active campaigns targeting this specific vulnerability have been reported as of the publication date. Public proof-of-concept exploits are likely to emerge given the public disclosure.
Websites and applications using baseweb JSite 1.0 are at risk. This includes deployments where user input is directly reflected in the application's output without proper sanitization. Shared hosting environments using baseweb JSite are particularly vulnerable, as they may be difficult to patch independently.
• php / web:
grep -r "/a/sys/user/save" /var/www/html/*• php / web:
curl -I http://your-site.com/a/sys/user/save?Name=<script>alert(1)</script>• generic web:
grep -r "Name = " /var/log/apache2/access.logdisclosure
漏洞利用状态
EPSS
0.16% (37% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation for CVE-2025-3788 is to upgrade to baseweb JSite version 1.0.1 or later, which contains the fix for this vulnerability. If upgrading is not immediately possible, consider implementing input validation and sanitization on the 'Name' parameter in the /a/sys/user/save endpoint to prevent malicious script injection. Web application firewalls (WAFs) configured to detect and block XSS attacks can also provide a temporary layer of protection. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload into the 'Name' field and verifying that it is properly sanitized.
Actualizar JSite a una versión posterior a la 1.0, si existe, que corrija la vulnerabilidad de Cross-Site Scripting (XSS). Si no hay actualizaciones disponibles, considerar deshabilitar o reemplazar el componente afectado. Validar y limpiar las entradas del usuario, especialmente el campo 'Name', para evitar la inyección de código malicioso.
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2025-3788 is a cross-site scripting (XSS) vulnerability in baseweb JSite versions 1.0 through 1.0, allowing attackers to inject malicious scripts via the 'Name' parameter in /a/sys/user/save.
You are affected if you are using baseweb JSite version 1.0. Upgrade to version 1.0.1 or later to mitigate the risk.
Upgrade to baseweb JSite version 1.0.1 or later. As a temporary workaround, implement input validation and sanitization on the 'Name' parameter.
While no active campaigns have been confirmed, the vulnerability has been publicly disclosed, increasing the likelihood of exploitation.
Refer to the baseweb project's official website or security advisories for the latest information and updates regarding CVE-2025-3788.