furk4nyildiz/cve-2025-50754-pocStored XSS in a CMS platform leads to remote code execution (CVE-2025-50754)
A PHP-based CMS platform (version 5) contains a stored Cross-Site Scripting (XSS) vulnerability in the "Report" feature. When an administrator views a user-submitted report, malicious JavaScript is executed within the admin panel context. This enables attackers to hijack the admin session and leverage the built-in template editor to upload a PHP web shell, resulting in full remote code execution (RCE) on the server.
An attacker submits a malicious JavaScript payload through the public-facing "Report" form. When a logged-in administrator views this content in the backend, the script executes in the administrator’s browser, exfiltrating session cookies.
After capturing the session, the attacker gains access to the administrative interface, particularly the template editor. Using this feature, the attacker injects PHP code into a .tpl file to establish a persistent web shell and execute arbitrary commands on the server.
Note: To prevent abuse, no specific payloads or code snippets are included. Organizations are strongly encouraged to implement input validation, session hardening, and access controls on admin features.
Successful exploitation was confirmed by uploading a custom web shell (s.php) via the template editor and executing OS-level commands. The following sanitized image shows the output of the id; ls -la command executed through the web shell:
This demonstrates that the attacker was able to execute commands and access filesystem contents under the privileges of the web server user.
uid=1003(t******_usr) gid=1006(t******_usr) groups=1006(t******_usr),995(fastmail),1002(fastsecure)
...
-rw-r--r-- 1 t******_usr t******_usr 6481 Nov 27 2024 rss.php
-rw-r--r-- 1 t******_usr t******_usr 64 Jul 31 12:24 s.php
No official patch is available from the vendor as of publication. To reduce risk:
Reported by Furkan Yıldız & Baha Yılmaz