CVE-2025-60837
BaseFortify
Publication date: 2025-10-23
Last updated on: 2025-10-27
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mingsoft | mcms | to 6.0.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-60837 is a reflected cross-site scripting (XSS) vulnerability in MCMS version 6.0.1. It occurs in the front-end component, specifically in the /mcms/search.do endpoint, where the content_title parameter is not properly sanitized. This allows attackers to inject malicious JavaScript code via crafted POST requests, which then executes in the context of a user's browser when they interact with the vulnerable page. [3]
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary JavaScript in the victim's browser without authentication. This can lead to session hijacking, theft of sensitive information, defacement, or other malicious actions performed on behalf of the user, potentially compromising user data and trust. [3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending crafted POST requests to the /mcms/search.do endpoint with malicious payloads in the content_title parameter to check for reflected XSS. For example, you can use curl to send a test payload: curl -X POST -d 'content_title=9999" onfocus=alert(1) autofocus="' http://<target>/mcms/search.do and observe if the JavaScript alert is triggered or if the payload is reflected unsanitized in the response. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable /mcms/search.do endpoint, applying input validation and sanitization on the content_title parameter to prevent script injection, and updating MCMS to a version that patches this vulnerability once available. Additionally, consider implementing Web Application Firewall (WAF) rules to block malicious payloads targeting this endpoint. [3]