CVE-2025-67648
BaseFortify
Publication date: 2025-12-11
Last updated on: 2026-03-17
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| shopware | shopware | From 6.4.6.0 (inc) to 6.6.10.10 (exc) |
| shopware | shopware | From 6.7.0.0 (inc) to 6.7.5.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Reflected Cross-Site Scripting (XSS) issue in Shopware's AuthController.php. A parameter from the login page URL, named waitTime, is directly rendered in the Twig template without proper input validation or sanitization. This allows an attacker to inject malicious code into the login page via the URL, which is then executed in the user's browser.
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute malicious scripts in the context of the affected website. This can lead to theft of user credentials, session hijacking, or other malicious actions performed on behalf of the user. It can compromise the integrity and confidentiality of user data and potentially disrupt user trust and site functionality.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Shopware to version 6.6.10.10 or later, or 6.7.5.1 or later, where the vulnerability is fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to inject malicious scripts via URL parameters on the login page, potentially leading to theft of user session tokens and administrative tokens. This unauthorized access and manipulation of user data could result in violations of data protection regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches. Therefore, the presence of this vulnerability could negatively impact compliance with these standards by exposing user data to attackers. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the Shopware Storefront login page for reflected XSS via the 'waitTime' and 'errorSnippet' URL parameters. You can attempt to inject HTML or JavaScript code in these parameters and observe if the payload is reflected unsanitized in the page response. For example, you can use curl or wget commands to send crafted requests and inspect the response for injected content. Example curl command: curl -i 'https://your-shopware-site/account/login?loginError=1&waitTime=<script>alert(1)</script>' and check if the script tag appears in the response body. Additionally, automated scanners or custom scripts can be used to detect reflected XSS by injecting payloads into these parameters and analyzing responses. Monitoring web server logs for suspicious requests containing script tags or unusual URL parameters may also help detect exploitation attempts. [1, 2]