CVE-2025-51541 in Shopware
Summary
by MITRE • 08/05/2025
A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/. The c_database_schema field fails to properly sanitize user-supplied input before rendering it in the browser, allowing an attacker to inject malicious JavaScript. This vulnerability can be exploited via a Cross-Site Request Forgery (CSRF) attack due to the absence of CSRF protections on the POST request. An unauthenticated remote attacker can craft a malicious web page that, when visited by a victim, stores the payload persistently in the installation configuration. As a result, the payload executes whenever any user subsequently accesses the vulnerable installation page, leading to persistent client-side code execution.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/10/2025
This stored cross-site scripting vulnerability in Shopware 6 represents a critical security flaw that enables persistent client-side code execution through improper input sanitization. The vulnerability specifically affects the installation interface at /recovery/install/database-configuration/ where the c_database_schema field processes user-supplied data without adequate validation or sanitization measures. This flaw allows attackers to inject malicious javascript code that gets stored in the application's configuration and subsequently executed whenever users access the vulnerable installation page.
The technical implementation of this vulnerability stems from inadequate input validation and output encoding practices within the Shopware 6 framework. The application fails to properly sanitize the c_database_schema field before rendering it in the browser context, creating a persistent XSS vector that can be exploited through stored data manipulation. This type of vulnerability falls under CWE-79 which specifically addresses cross-site scripting flaws where untrusted data is improperly integrated into web pages without adequate sanitization or encoding.
The operational impact of this vulnerability is particularly severe as it enables attackers to achieve persistent code execution without requiring authentication. The absence of CSRF protections on the POST request means that attackers can leverage a simple malicious web page to deliver the payload to victims who visit the page. This creates a dangerous scenario where legitimate users who access the vulnerable installation interface become unwitting participants in the attack, as the malicious code executes within their browser context whenever they navigate to the affected page.
The exploitation chain begins with an unauthenticated attacker crafting a malicious payload and delivering it through a CSRF attack vector. When a victim visits the malicious page, the payload gets stored in the application's database configuration, creating a persistent threat that affects any user who subsequently accesses the vulnerable installation interface. This persistent nature makes the vulnerability particularly dangerous as it can compromise multiple users over time without requiring repeated exploitation attempts.
Security mitigations for this vulnerability should include immediate input sanitization and output encoding for all user-supplied data within the installation interface. The application must implement proper CSRF protection mechanisms on all state-changing requests, including the database configuration endpoint. Additionally, the system should enforce strict validation of database schema inputs and implement comprehensive output encoding to prevent malicious code execution. Organizations should also consider implementing web application firewalls and monitoring for suspicious input patterns. This vulnerability aligns with ATT&CK technique T1566 which covers spearphishing attacks that can lead to code execution through web-based exploits, and T1190 which addresses exploitation of vulnerabilities in web applications through cross-site scripting attacks.