Skip to content

Instantly share code, notes, and snippets.

@b1uel0n3

b1uel0n3/CVE-2025-64047.md

Created November 20, 2025 08:45
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save b1uel0n3/b105ad05dbcd3fe148a26e8180dddda7 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save b1uel0n3/b105ad05dbcd3fe148a26e8180dddda7 to your computer and use it in GitHub Desktop.
Download ZIP
Reference for CVE-2025-64047
Raw
CVE-2025-64047.md

Vulnerability Report: CVE-2025-64047 - OpenRapid RapidCMS 1.3.1 Cross-Site Scripting (XSS)

Vulnerability Summary

OpenRapid RapidCMS version 1.3.1 contains a Cross-Site Scripting (XSS) vulnerability in the /user/user-move.php endpoint.

Affected Product

  • Vendor: OpenRapid
  • Product: RapidCMS
  • Version: 1.3.1
  • Vulnerable Component: /admin/user/user-move.php

Vulnerability Details

  • Vulnerability Type: Cross-Site Scripting (XSS)
  • Attack Type: Remote
  • Attack Vectors:
    • Network-based attack
    • Remote unauthenticated attacker via crafted 'username' GET parameter
    • User interaction required
  • Impact: Information Disclosure

Technical Description

The vulnerability exists in the user-move.php component of RapidCMS 1.3.1. An attacker can exploit this vulnerability by crafting malicious input in the 'username' GET parameter, which is not properly sanitized before being reflected in the application's output.

Attack Scenario

A remote, unauthenticated attacker can craft a malicious URL containing XSS payload in the 'username' parameter. When an authenticated administrator visits this crafted URL, the malicious script executes in the context of the administrator's session, potentially leading to session hijacking, unauthorized actions, or information disclosure.

References

Discoverer

b1uel0n3

CVE Identifier

CVE-2025-64047

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment