Stored XSS in HAXCMS PHP via Case-Sensitivity Mismatch in HTML Upload

Vulnerability Overview Title: Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation Description: Summary: The endpoint does not distinguish between uppercase and lowercase letters when validating uploaded files, writing the filename to disk exactly as provided. However, rules enforce in a case-sensitive manner for HTML files. HTML files uploaded with uppercase extensions (e.g., ) are still served as , but the forced download header does not take effect, causing the browser to render the file as inline HTML and execute any embedded JavaScript. This bypasses the mitigation for CVE-2020-22704. Details: - There is a discrepancy in case sensitivity between the upload path and the forced download rules. - The upload validation logic ( ) uses the case-insensitive flag, accepting extensions regardless of case. - The filename is written to disk verbatim, for example, . - The forced download rule (line 109 in ) uses , which is case-sensitive. - This rule matches and but does not match , , or . Apache still serves the file as because MIME type parsing is case-insensitive; the only mechanism controlling inline rendering is the forced header. - The correct fix is to convert the extension to lowercase during upload, ensuring that the rules can catch any HTML file accepted by any PHP validator. Switching to serves as a useful secondary defense but does not address the root cause, which is the server preserving user-controlled casing. Affected Versions Affected Versions: <= 25.0.0 Fixed Versions: 26.0.0 Severity: High (8.7 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: Required - Scope: Changed - Confidentiality: High - Integrity: High - Availability: None Remediation Fixed Versions: 26.0.0 Recommendation: Convert the file extension to lowercase during upload to ensure that rules correctly capture all HTML files. POC Code Exploitation Steps 1. Log in to the HAXCMS deployment (e.g., ). 2. Create or open a site from the dashboard. 3. Upload via the HAX editor. Click the media/image button in the toolbar, select "Upload File," and choose from your machine. The upload succeeds because the PHP validator matches case-insensitively. Note the file path in the response - it will be . 4. Access the uploaded file in the browser at . The page is rendered inline (not downloaded), and the script executes. You will see terminal-style output showing each step of the exploit chain completed on the visitor's own site. 5. Send the link to another authenticated user. When they open it, the same exploit chain will trigger. They do not need to have any relationship with you or access your site. 6. Check your webhook. It will receive a JSON payload containing the visitor's JWT, username, user_token, form_token, site count, and the name and page count for each site. Impact Uploaded HTML files with uppercase extensions are rendered inline and execute arbitrary JavaScript within the HAXcms context. As demonstrated by the POC, this leads to full account takeover: the attacker obtains the visitor's JWT, API tokens, and a complete list of sites without requiring the visitor to click any additional links.

Goal Reached Thanks to every supporter — we hit 100%!

Stored XSS in HAXCMS PHP via Case-Sensitivity Mismatch in HTML Upload

More from this source