CVE-2019-25301
Persistent XSS in Millhouse-Project Comment Submission Allows Script Injection
Publication date: 2026-02-06
Last updated on: 2026-02-06
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| thrsrossi | millhouse-project | 1.414 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2019-25301 is a persistent cross-site scripting (XSS) vulnerability in Millhouse-Project version 1.414. It occurs in the comment submission functionality, specifically through the 'content' parameter in the add_comment_sql.php script."}, {'type': 'paragraph', 'content': 'Attackers can inject malicious JavaScript code into comments, which are then stored persistently and executed in the browsers of users who view these comments. This allows the attacker to run arbitrary scripts in the context of the vulnerable web application.'}] [2, 3]
How can this vulnerability impact me? :
This vulnerability can lead to the execution of arbitrary JavaScript code in the browsers of users who view the injected comments.
- Session hijacking, where attackers steal user session tokens.
- Defacement or alteration of the website content.
- Other malicious activities that can be performed through injected scripts, such as phishing or spreading malware.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by testing the comment submission functionality of the Millhouse-Project application, specifically by sending crafted POST requests to the /includes/add_comment_sql.php endpoint with malicious JavaScript payloads in the 'content' parameter."}, {'type': 'paragraph', 'content': 'A common detection method is to use curl or similar HTTP clients to send a POST request with a script payload and observe if the script is stored and executed when viewing the comments.'}, {'type': 'list_item', 'content': 'Example command to test the vulnerability using curl:'}, {'type': 'list_item', 'content': 'curl -X POST -d \'content=<script>alert("TEST")</script>\' http://[target]/includes/add_comment_sql.php'}, {'type': 'paragraph', 'content': 'If the alert script executes when viewing the comments, the vulnerability is present.'}] [2, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': "Immediate mitigation steps include sanitizing and validating all user inputs, especially the 'content' parameter in the comment submission functionality, to prevent injection of malicious scripts."}, {'type': 'paragraph', 'content': 'Implement proper output encoding to neutralize any scripts before rendering comments in the browser.'}, {'type': 'paragraph', 'content': 'If possible, apply patches or updates from the vendor or project repository that address this vulnerability.'}, {'type': 'paragraph', 'content': 'As a temporary measure, restrict or disable the comment submission feature until a fix is applied.'}] [3]