Sanluan PublicCMS CVE-2025-7949

The vulnerability requires an authenticated user with low-level admin privileges to access the admin panel and view or interact with the preview functionality. Specifically, the url parameter in the admin cmsDiy preview endpoint must be user-controllable and unvalidated. The attack requires user interaction (UI:P in CVSS vector) - a targeted admin or CMS user must click or follow a crafted link containing the malicious url parameter. The vulnerability does NOT affect unauthenticated users or those without admin access. Default PublicCMS deployments with the vulnerable preview.html template are exploitable if an authenticated low-privilege admin exists; however, highly restricted deployments with no low-privilege admins face reduced practical risk.

This is a low-priority vulnerability despite network attack vector. The CVSS score of 2.0 (CVSSv4.0) correctly reflects minimal real-world impact: integrity impact only (VI:L), no confidentiality or availability loss. The EPSS score of 0.07% (21st percentile) indicates very low exploitation probability in the wild, which aligns with the vulnerability's limited usefulness for attackers - open redirects primarily enable social engineering and phishing, not direct compromise. The attack chain requires three prerequisites: (1) attacker authentication to the admin panel, (2) attacker discovery or enumeration of legitimate admin users, and (3) victim clicking a crafted link. Public exploit availability (POC disclosed) raises awareness but does not increase real-world risk given these constraints. This vulnerability should not block deployments or trigger urgent patching, but should be included in routine update cycles. Organizations with strong admin access controls and user security awareness training face minimal exposure.

An attacker with valid credentials to the PublicCMS admin panel crafts a malicious preview URL containing a crafted url parameter pointing to a phishing site (e.g., /admin/cmsDiy/preview.html?url=https://attacker.evil.com). The attacker sends this link via email or message to a legitimate admin user. When the admin clicks the link, they are redirected to the attacker-controlled site, which may harvest credentials or credentials.