6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-70958

CVE-2025-70958: Subrion CMS vulnerable to cross-site scripting

Multiple reflected cross-site scripting (XSS) vulnerabilities in the installation module of Subrion CMS v4.2.1 allows attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted payload into the dbuser, dbpwd, and dbname parameters.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-70958

CVE-2025-70958:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
intelliants/subrion	composer	<= 4.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a reflected XSS in the installation module of Subrion CMS. The user-provided dbuser, dbpwd, and dbname parameters are used to establish a database connection during the 'configuration' step of the installation process. The code for this is located in install/modules/module.install.php.

When a user submits the database configuration form, the application attempts to connect to the database using the provided credentials. If an error occurs during this process (e.g., invalid credentials), the error message from the MySQLi driver is included in the response sent back to the user.

The vulnerability exists because these error messages can contain the user-supplied dbuser or dbname values without proper HTML entity encoding. An attacker can submit a malicious script as the value for dbuser, for example. The mysqli_connect() function will fail, and the mysqli_connect_error() function will return an error message containing the attacker's script. This message is then rendered in the browser, executing the script in the context of the user's session.

The vulnerable code snippet is:

$link = @mysqli_connect(iaHelper::getPost('dbhost'), iaHelper::getPost('dbuser'), iaHelper::getPost('dbpwd'), '', iaHelper::getPost('dbport', 3306));
if (mysqli_connect_errno()) {
    $error = true;
    $message = 'MySQL server: ' . mysqli_connect_error() . '<br>';
}

And for dbname:

if (!$error && !mysqli_select_db($link, iaHelper::getPost('dbname'))) {
    $error = true;
    $message = 'Could not select database ' . iaHelper::_html(iaHelper::getPost('dbname')) . ': ' . mysqli_error($link);
}

While dbname is passed through iaHelper::_html(), the vulnerability report implies this is not sufficient. The primary vulnerability is with dbuser and dbpwd which are not sanitized before being part of the error message from mysqli_connect_error().

Since the vulnerable code is not within a defined function but in the global scope of the module.install.php script, a profiler would likely attribute the execution time to the script itself. Therefore, module.install.php is identified as the vulnerable component.

Vulnerable functions

module.install.php

install/modules/module.install.php

The vulnerability exists in the main body of the `module.install.php` script, which is executed during the installation process. The script takes `dbuser`, `dbpwd`, and `dbname` as POST parameters and uses them to connect to a database. If the database connection fails, the error message from the database driver, which may contain the unescaped user input, is reflected back to the user. This allows for a reflected Cross-Site Scripting (XSS) attack. Specifically, the `mysqli_connect_error()` and `mysqli_error()` functions can return content that includes the malicious payload. The `iaHelper::_html()` function used for the `dbname` parameter is also insufficient to prevent this vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.