Full Report
Cross-site Scripting (XSS) vulnerability (CVE-2025-4379) has been found in Studio Fabryka DobryCMS software.
Analysis Summary
# Vulnerability: Cross-Site Scripting in DobryCMS (CVE-2025-4379)
## CVE Details
- CVE ID: CVE-2025-4379
- CVSS Score: Not explicitly provided, estimated as Medium/High based on XSS impact.
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
## Affected Systems
- Products: Studio Fabryka DobryCMS
- Versions: 1.\* and 2.\* (and lower)
- Configurations: Standard installations susceptible to request parameter manipulation.
## Vulnerability Description
The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw stemming from improper input validation in the `szukaj` parameter within the DobryCMS software. An attacker can craft a special URL containing malicious JavaScript. If a victim opens this crafted URL, the script will execute in the victim's browser by leveraging the un-sanitized input.
## Exploitation
- Status: PoC likely available (implied by responsible disclosure, though not explicitly stated in context, XSS flaws usually have accessible PoC).
- Complexity: Low (Reflected XSS typically requires only sending a crafted link to a user).
- Attack Vector: Network (Victim must click a malicious link).
## Impact
- Confidentiality: High (Potential for session hijacking, cookie theft).
- Integrity: High (Ability to modify content viewed by the user).
- Availability: Low (Primarily focused on user-side impact).
## Remediation
### Patches
- A hotfix addressing the vulnerability was released on 2025-04-29.
- Note: This fix was implemented as a hotfix and **did not increment the official software version number.**
### Workarounds
- No explicit workarounds (other than patching) are listed in the provided text. Applying the vendor-released hotfix is the required action.
## Detection
- Indicators of Compromise: Unusual scripts executing in the browser after visiting certain application pages, specifically those processing the `szukaj` parameter.
- Detection methods and tools: Web Application Firewalls (WAFs) configured to detect XSS payloads in HTTP requests, and specific logging/alerting for unusual characters or script tags within GET parameters targeting public-facing web application endpoints.
## References
- Vendor advisory/Source Material: CERT Polska (Publication date 23 May 2025)
- Relevant links - defanged:
- hxxps://www.cve.org/CVERecord?id=CVE-2025-4379
- hxxps://cert.pl/en/publications/