CVE-2025-2352 in starsea-mall
Summary
by MITRE • 03/17/2025
A vulnerability, which was classified as problematic, has been found in StarSea99 starsea-mall 1.0. This issue affects some unknown processing of the file /admin/indexConfigs/save of the component Backend. The manipulation of the argument categoryName leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/10/2025
This vulnerability represents a critical cross site scripting flaw in the StarSea99 starsea-mall 1.0 web application, specifically within the backend administrative component. The issue manifests in the /admin/indexConfigs/save endpoint where the categoryName parameter is processed without adequate input validation or output sanitization. This allows malicious actors to inject arbitrary JavaScript code through the categoryName field, which then executes in the context of other users' browsers when they view the affected pages. The vulnerability's classification as problematic indicates a significant security risk that could compromise user sessions and potentially lead to full system compromise through session hijacking or data exfiltration attacks.
The technical exploitation of this XSS vulnerability occurs through remote manipulation of the categoryName parameter, making it particularly dangerous as attackers can craft malicious URLs or inject payloads through various attack vectors including email phishing, social engineering, or compromised website links. The lack of versioning information in the product complicates remediation efforts as security researchers cannot determine which specific releases are vulnerable or patched, creating a significant challenge for organizations attempting to assess their risk exposure. The vulnerability's disclosure to the public means that attack vectors are now widely known and potentially automated, increasing the likelihood of successful exploitation across affected systems.
From an operational perspective, this vulnerability creates substantial risk for organizations using the starsea-mall 1.0 platform, as it allows attackers to execute arbitrary code in victims' browsers, potentially stealing session cookies, redirecting users to malicious sites, or defacing the administrative interface. The lack of vendor response after early notification represents a critical failure in the security disclosure process, leaving users without official patches or mitigation guidance. This vulnerability aligns with CWE-79, which specifically addresses cross site scripting flaws in web applications, and maps to ATT&CK technique T1566 for initial access through malicious links or content, and T1071 for application layer protocol usage in executing malicious code.
Organizations should implement immediate mitigations including input validation and output encoding for all user-supplied data, particularly in administrative interfaces where the categoryName parameter is processed. Web application firewalls should be configured to detect and block suspicious input patterns targeting the affected endpoint. Additionally, organizations should consider implementing content security policies to prevent execution of unauthorized scripts, and conduct thorough security assessments of all administrative components to identify similar vulnerabilities. The absence of vendor response underscores the importance of maintaining internal security monitoring and incident response capabilities, as well as exploring alternative solutions or vendor replacements for products with inadequate security support. Regular security testing and vulnerability scanning should be implemented to identify similar issues in other components of the application stack that may present similar attack surfaces.