CVE-2025-25062:Stored Cross-Site Scripting (XSS) in Backdrop CMS v1.28.2

On January 23, 2025, security researchers from Astra identified a stored cross-site scripting (XSS) vulnerability in Software Freedom Conservancy Backdrop CMS v1.28.2. The vulnerability exists in the Comment Editing section, where the application fails to properly sanitize user input, allowing authenticated attackers to inject malicious scripts.

Stored XSS vulnerabilities occur when an application stores user-supplied input without proper validation, making it accessible to other users. This can lead to various security risks, including session hijacking, credential theft, and persistent script execution in the victim’s browser.

Technical Breakdown

How was it discovered?

The vulnerability was identified in the Comment Editing section, where input validation is missing. Attackers can inject JavaScript payloads that persist within the application and execute when an admin or another privileged user interacts with the affected content.

Steps to reproduce the vulnerability

1. Create two accounts: One with admin privileges and another with user privileges.
2. Admin Account:
   • Navigate to the “Content” section.
   • Select “Post” under “Manage Content” and create a post with random details.
   • Enable commenting on the post.
3. User Account:
   • Copy the URL of the newly created post and access it from the user account.
   • Submit a comment with a random message.
4. Modify the request using Burp Suite:
   • Intercept the comment request.
     

Inject the following JavaScript payload into the comment parameter:

• <image/src/onerror=('XSS')>
• Forward the request.
  

5. Admin Account:
   • Refresh the post and observe that the comment appears as expected.
   • Click the “Edit” button on the comment.
   • The stored XSS payload triggers an alert, confirming the vulnerability.

Impact of Stored XSS Vulnerability

• Session Hijacking: Attackers can steal session cookies, gaining unauthorized access.
• Data Theft: Malicious scripts can exfiltrate sensitive user information.
• Content Manipulation: Attackers can deface pages or modify displayed content.
• Persistent Exploitation: The injected scripts remain active within the application, affecting multiple users over time.

Current Status

The vendor was notified about the vulnerability in Software Freedom Conservancy Backdrop CMS v1.28.2, and they promptly implemented a patch in v1.29.3 of the software.

What Can You Do?

To avoid potential exploitation, users are strongly advised to update Volamarg PMS to v1.29.3, which includes essential security patches.