CVE-2025-51541
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-08-05

Last updated on: 2025-09-10

Assigner: MITRE

Description
A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/. The c_database_schema field fails to properly sanitize user-supplied input before rendering it in the browser, allowing an attacker to inject malicious JavaScript. This vulnerability can be exploited via a Cross-Site Request Forgery (CSRF) attack due to the absence of CSRF protections on the POST request. An unauthenticated remote attacker can craft a malicious web page that, when visited by a victim, stores the payload persistently in the installation configuration. As a result, the payload executes whenever any user subsequently accesses the vulnerable installation page, leading to persistent client-side code execution.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-08-05
Last Modified
2025-09-10
Generated
2026-05-07
AI Q&A
2025-08-05
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
shopware shopware From 6.1.0 (inc) to 6.2.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a stored cross-site scripting (XSS) issue in the Shopware 6 installation interface at /recovery/install/database-configuration/. It occurs because the c_database_schema field does not properly sanitize user input before displaying it in the browser. An attacker can exploit this by using a Cross-Site Request Forgery (CSRF) attack to inject malicious JavaScript code that is stored persistently. When any user later visits the vulnerable installation page, the malicious code executes in their browser.


How can this vulnerability impact me? :

This vulnerability can lead to persistent client-side code execution in the browsers of users who visit the vulnerable installation page. An attacker can inject malicious scripts that may steal sensitive information, hijack user sessions, perform unauthorized actions on behalf of users, or deliver malware. Since the attack can be performed by an unauthenticated remote attacker via a crafted web page, it poses a significant security risk to users and the integrity of the affected system.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart