sunkaifei FlyCMS CVE-2025-15093

The redirectUrl parameter in the Admin Login component (IndexAdminController.java) must accept and reflect unsanitized user input without validation. Exploitation requires an authenticated user (or a user completing authentication) to click a malicious link crafted by the attacker, as the CVSS vector specifies UI:P (user interaction present). The attack is non-automatable and does not trigger without victim action. Exploitation is limited to reflected XSS in the admin session context; stored XSS is not indicated by the CVE description. Default configurations of FlyCMS are vulnerable if the redirectUrl parameter is not explicitly restricted or validated in deployment configuration.

This vulnerability presents low real-world risk despite public exploit availability. The CVSS 4.0 vector shows network accessibility (AV:N) but includes several limiting factors: user interaction required (UI:P), unauthenticated attack scope (PR:N), and low impact (VC:N/VI:L/VA:N). The EPSS score of 0.02% (6th percentile) contradicts the public POC availability, suggesting exploitation is primarily theoretical or requires specific social engineering conditions. The vendor's non-response and continuous rolling-release deployment model prevent standard patch verification, but the integrity impact is confined to the victim's session context. Attack complexity is low (AC:L), but the combination of UI:P requirement and low EPSS indicates this is not a priority for widespread active exploitation. Organizations using FlyCMS should assess admin user awareness of phishing risks and implement content security policies to mitigate reflected XSS.

An attacker crafts a malicious link to the FlyCMS admin login page with a redirectUrl parameter containing JavaScript payload (e.g., https://victim-site.com/admin/login?redirectUrl=javascript:alert(1)), then sends it to a FlyCMS administrator via phishing email. When the admin clicks the link and logs in successfully, the browser executes the injected script in the context of the admin's session, potentially stealing session cookies or performing actions on behalf of the admin. Public exploit code demonstrating this technique is available on GitHub issue #15.