4.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-63522

CVE-2025-63522: FeehiCMS is vulnerable to reverse tabnabbing

Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-63522

CVE-2025-63522:

4.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
feehi/feehicms	composer	<= 2.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic case of reverse tabnabbing. It exists in the 'Comments Management' section of FeehiCMS. The analysis of the provided information, including the GitHub issue and the source code, points to the CommentController as the central component for this functionality.

The root cause of the vulnerability is in how user-submitted content is rendered. Specifically, in the backend/views/comment/index.php file, the GridView widget is configured to display the content of a comment using 'format' => 'html'. This setting tells the Yii framework to output the content as raw HTML.

The exploit scenario is as follows:

An attacker submits a comment containing a hyperlink with a target="_blank" attribute. The update action in CommentController handles the submission and stores the malicious content in the database.
A user with administrative privileges navigates to the comment management page, which triggers the index action of the CommentController.
The index action renders the index.php view. The GridView in this view displays the list of comments.
The attacker's comment content, including the malicious link, is rendered as HTML. Because the application does not add rel="noopener noreferrer" to the link, it becomes vulnerable.
When the administrator clicks the link, the new page can change the location of the original tab to a phishing page, potentially stealing the administrator's credentials.

The function backend\controllers\CommentController::actions is identified as the key vulnerable function because it defines and configures the index action that leads to the vulnerable rendering. While the vulnerability is technically in the view file, the actions method is the entry point in the application's code that orchestrates this vulnerable behavior.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.