Overview
The cybersecurity landscape is no stranger to vulnerabilities that can potentially compromise systems and leak sensitive data. One such vulnerability is the CVE-2025-50754 that affects the Unisite CMS version 5.0. This vulnerability is a stored Cross-Site Scripting (XSS) flaw found in the “Report” functionality of the CMS. The impact of this vulnerability is significant as it allows attackers to hijack the admin session and execute remote code on the server. All users of Unisite CMS 5.0 are potentially at risk, making it imperative to understand the nature of this vulnerability and take swift actions to mitigate it.
Vulnerability Summary
CVE ID: CVE-2025-50754
Severity: Critical (9.6 CVSS Score)
Attack Vector: Stored Cross-Site Scripting (XSS)
Privileges Required: User level
User Interaction: Required
Impact: Hijacking of admin session leading to full remote code execution and potential system compromise
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Unisite CMS | 5.0
How the Exploit Works
A stored Cross-Site Scripting (XSS) vulnerability is present in the “Report” functionality of Unisite CMS 5.0. This vulnerability is exploited when an attacker submits a malicious script that gets stored on the server. When an administrator views the “Report” section in the admin panel, the malicious script is rendered. This allows the attacker to hijack the admin session. Moreover, the attacker can leverage the template editor to upload and execute a PHP web shell on the server, leading to full remote code execution.
Conceptual Example Code
The following is a conceptual example of how the vulnerability might be exploited. The attacker submits a malicious script in the “Report” functionality that gets stored on the server:
POST /report HTTP/1.1
Host: unisiteCMS.example.com
Content-Type: text/html
{
"<script>malicious_code_here</script>"
}When an admin views the report, the script executes, hijacking the admin session and potentially enabling remote code execution. This is why it is essential to patch this vulnerability immediately or implement WAF/IDS as a temporary mitigation measure.