CVE-2025-12224
BaseFortify
Publication date: 2025-10-27
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| iqbolshoh | php-business-website | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a cross-site scripting (XSS) flaw in the Iqbolshoh php-business-website software, specifically in the admin/contact.php file. It occurs because the twitter parameter is not properly neutralized, allowing an attacker to inject malicious scripts. When exploited, these scripts run in the context of a victim's browser, potentially leading to unauthorized actions. The attack can be initiated remotely but requires user interaction to succeed. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to execute arbitrary scripts in users' browsers when they interact with the affected page. This can lead to session hijacking, defacement, or other malicious activities that compromise the integrity of the web application. However, it does not affect confidentiality or availability directly. Exploitation requires user interaction and can be performed remotely. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by identifying instances of the vulnerable software exposing the affected file admin/contact.php. One suggested method is using Google dorking with queries such as `inurl:admin/contact.php` to find potentially vulnerable endpoints. Additionally, inspecting HTTP requests that include the twitter parameter in admin/contact.php for suspicious or malicious script content can help detect exploitation attempts. There is a publicly available proof-of-concept exploit on GitHub that can be used to test for the vulnerability. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the vulnerable php-business-website software with an alternative solution, as no patches or countermeasures are currently available. Since the product uses a rolling release model and no specific fixed versions exist, upgrading may not resolve the issue. Additionally, restricting access to the admin/contact.php page and sanitizing or validating the twitter parameter input to prevent script injection can help reduce risk. [1]