CVE-2019-25280
Remote HTML Injection in Yahei-PHP Prober 0.4.7 Enables XSS
Publication date: 2026-01-08
Last updated on: 2026-01-08
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yahei | yahei-php_prober | 0.4.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2019-25280 is a remote HTML injection vulnerability in Yahei-PHP Prober version 0.4.7. It occurs because the 'speed' GET parameter in the prober.php script is not properly sanitized before being echoed back in the HTML response. This allows an attacker to inject arbitrary HTML or JavaScript code, which executes in the context of the affected website, leading to cross-site scripting (XSS). The vulnerability arises from the direct output of the 'speed' parameter without escaping, enabling remote exploitation without local access. [2, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious HTML or JavaScript code in the browsers of users visiting the affected website. This can lead to theft of user data, session hijacking, defacement of the website, or redirection to malicious sites. Since the attack is remote and requires no local access, it poses a risk to the confidentiality and integrity of user interactions with the site. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the 'speed' GET parameter in the /prober.php script for improper sanitization and HTML injection. You can use curl or a web browser to send a request with a crafted 'speed' parameter containing HTML or JavaScript code and observe if it is reflected unsanitized in the response. For example, use the command: curl -G 'http://your-target/prober.php' --data-urlencode "speed=<marquee>test</marquee>" and check if the <marquee> tag appears in the HTML response, indicating the vulnerability. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or restricting access to the vulnerable /prober.php script, especially the 'speed' parameter, until a patch or fix is available. Additionally, implement input validation and sanitization on the 'speed' parameter to prevent injection of arbitrary HTML or scripts. If possible, apply web application firewall (WAF) rules to block malicious payloads targeting the 'speed' parameter. Monitoring and restricting user input to safe values can reduce the risk of exploitation. [2, 3]