FeehiCMS 2.1.1 Exposed: XSS Vulnerability in User Update (CVE-2025-63520)

Overview

CVE-2025-63520 identifies a Cross-Site Scripting (XSS) vulnerability within FeehiCMS version 2.1.1. This vulnerability is located in the User Update functionality, specifically through the id parameter of the ?r=user%2Fupdate route. An attacker can exploit this flaw to inject malicious scripts into the application, potentially compromising user accounts and data.

Technical Details

The vulnerability stems from insufficient input validation and sanitization of the id parameter within the User Update feature. By crafting a malicious URL that includes JavaScript code in the id parameter, an attacker can inject and execute arbitrary scripts within the context of a user’s browser when they access the affected page. The lack of proper encoding allows the injected script to be interpreted as legitimate code by the browser.

For example, a malicious URL might look like this:

http://example.com/index.php?r=user%2Fupdate&id=<script>alert('XSS')</script>

When a user visits this URL, the alert('XSS') script will execute, demonstrating the XSS vulnerability. More sophisticated attacks could involve stealing cookies, redirecting users to malicious websites, or defacing the application.

CVSS Analysis

Currently, the CVE entry does not specify a CVSS score. However, given that this is an XSS vulnerability, it’s likely to be classified as a medium to high severity issue, depending on the context of execution and the privileges of the affected user. We recommend checking the NVD and other vulnerability databases for updates to the CVSS score.

Possible Impact

The impact of this XSS vulnerability can be significant:

• Account Compromise: Attackers can steal user session cookies, gaining unauthorized access to user accounts.
• Data Theft: Sensitive information displayed on the affected page can be exfiltrated by the attacker.
• Website Defacement: Malicious scripts can modify the appearance of the website, potentially damaging its reputation.
• Redirection to Malicious Sites: Users can be redirected to phishing websites or sites hosting malware.

Mitigation and Patch Steps

To mitigate this vulnerability, the following steps are recommended:

1. Upgrade FeehiCMS: Check for an updated version of FeehiCMS that includes a patch for CVE-2025-63520. Upgrade to the latest stable version as soon as possible.
2. Input Validation and Sanitization: Implement robust input validation and sanitization techniques to prevent the injection of malicious scripts. Specifically, encode user-supplied data before rendering it in HTML.
3. Web Application Firewall (WAF): Deploy a Web Application Firewall (WAF) to filter out malicious requests and protect against XSS attacks.
4. Content Security Policy (CSP): Implement a Content Security Policy (CSP) to restrict the sources from which scripts can be loaded, reducing the risk of XSS attacks.

References

CVE-2025-63520 Details on GitHub
FeehiCMS Issue #74 on GitHub
NIST NVD CVE-2025-63520 Entry