CVE-2025-3554 in phpshe
Summary
by MITRE • 04/14/2025
A vulnerability was found in phpshe 1.8. It has been rated as problematic. This issue affects some unknown processing of the file api.php?mod=cron&act=buyer. The manipulation of the argument act leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/10/2025
The vulnerability identified as CVE-2025-3554 resides within the phpshe 1.8 content management system, representing a significant security flaw that has been officially classified as problematic. This vulnerability manifests through the api.php script which processes requests with the module parameter set to cron and the action parameter set to buyer. The core issue emerges from insufficient input validation and output sanitization within this specific processing pathway, creating an environment where malicious actors can exploit the system through cross-site scripting attacks.
The technical flaw specifically involves the improper handling of the act parameter within the cron module's buyer functionality. When an attacker manipulates this parameter, the system fails to adequately sanitize the input before incorporating it into the response output. This creates a classic cross-site scripting vulnerability where malicious scripts can be injected and executed within the context of other users' browsers. The vulnerability's classification as remotely exploitable means that attackers do not require physical access to the system or local network privileges to carry out the attack, significantly expanding the potential attack surface.
The operational impact of this vulnerability extends beyond simple script injection, as it can potentially enable attackers to steal user sessions, deface websites, redirect users to malicious sites, or harvest sensitive information from authenticated sessions. The disclosure of the exploit to the public community means that this vulnerability is no longer a theoretical threat but an active risk that malicious actors can readily implement. This particular attack vector targets the cron module functionality, which typically handles automated background processes, making the exploitation potentially more insidious as it could be triggered without user interaction in certain scenarios.
Security professionals should note that this vulnerability aligns with CWE-79, which specifically addresses cross-site scripting flaws in web applications. The ATT&CK framework categorizes this as a web application attack pattern where adversaries leverage input validation weaknesses to execute malicious code. Organizations running phpshe 1.8 systems must immediately implement mitigations including input validation, output encoding, and parameter sanitization measures. The recommended approach involves updating to the latest version of phpshe where this vulnerability has been patched, implementing web application firewalls, and conducting thorough security audits of all input processing functions within the application's core modules. Additionally, network segmentation and access controls should be strengthened to limit potential exploitation pathways and reduce the overall attack surface.