Executive brief
HAX CMS is a website editor that allows users to embed content from other websites using iframes. An authenticated attacker can create a malicious website with an iframe pointing to a fake login server, which then harvests credentials from unsuspecting visitors. This enables credential theft and account compromise through social engineering.
Technical details
The vulnerability exists in the iframe website block functionality (Operations.php:868, saveNode API endpoint) which does not properly validate or restrict the target URL supplied by users. An authenticated attacker can set an iframe to point to an attacker-controlled server running tools like Responder to intercept authentication requests. When other users visit the malicious site, they are prompted to authenticate, and any credentials entered are captured by the attacker. The vulnerability requires user interaction (victim visiting the site and entering credentials) and the attacker to already be authenticated. Patch version 11.0.0 and later address this issue.
Affected products
- HAX haxcms-nodejs <=10.0.6
- HAX haxcms-php <=10.0.6
Timeline
- 2025-06-09: disclosed: Advisory published
- 2025-06-09: patched: Version 11.0.0 released