Executive brief
OpenRapid RapidCMS, a content management system, contains a security flaw that allows attackers to execute malicious scripts in a user's browser. By tricking an administrator into clicking a specially crafted link, an attacker could potentially hijack their session or perform unauthorized actions on the website. This could lead to the exposure of sensitive user data or unauthorized changes to site content.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in OpenRapid RapidCMS 1.3.1 within the /user/user-move.php (also referenced as /admin/user/user-move.php) component. The vulnerability is caused by improper neutralization of user-supplied input in the 'username' GET parameter before it is reflected back to the user. A remote, unauthenticated attacker can exploit this by crafting a malicious URL and inducing a victim, such as an authenticated administrator, to visit it. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, which can lead to session hijacking or unauthorized administrative actions.
Affected products
- OpenRapid RapidCMS 1.3.1
Timeline
- 2025-11-20: disclosed: Vulnerability discovered and reported by b1uel0n3
- 2025-11-24: advisory: CVE-2025-64047 published by NVD/MITRE