CVE-2025-59412
BaseFortify
Publication date: 2025-09-22
Last updated on: 2025-09-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cubecart | cubecart | to 6.5.11 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in CubeCart's product reviews feature allows an attacker to submit malicious HTML code in the review description. Because the input was not properly sanitized before being displayed, once an administrator approves the review, the malicious HTML is rendered on the product page for all visitors. This can lead to cross-site scripting (XSS) attacks, enabling attackers to redirect users to malicious websites or display unwanted content. [3]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow attackers to inject malicious HTML into product reviews that are displayed to all visitors. This can result in users being redirected to phishing or malware sites, exposure to unwanted or harmful content, and damage to the website's reputation and user trust. It poses a moderate security risk by compromising confidentiality and integrity of user interactions on the site. [3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for product reviews containing HTML tags in the review description field, especially those that include suspicious links or scripts. You can query the database for reviews with HTML tags or inspect the product pages for rendered HTML injected via reviews. For example, if you have access to the CubeCart database, you could run a SQL query like: SELECT review FROM product_reviews WHERE review LIKE '%<%>%'; to find reviews containing HTML tags. Additionally, monitoring HTTP traffic for unusual redirects or injected content on product pages may help detect exploitation attempts. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading CubeCart to version 6.5.11 or later, where the vulnerability is patched by sanitizing user-submitted reviews using a function that converts HTML to plain text. If upgrading is not immediately possible, temporarily disable or restrict the product reviews feature to prevent malicious input. Also, ensure that administrators carefully review and reject any suspicious reviews containing HTML or links. Applying server-side input sanitization similar to the patch—removing HTML tags and decoding entities before storing or displaying reviews—can help mitigate the risk. [1, 2, 3]