CVE-2025-51487: MoonShine Stored Cross-Site Scripting Vulnerability in Create Article
Summary
CVE-2025-51487: moonshine Stored Cross-Site Scripting Vulnerability in Create Article. Affects moonshine/moonshine versions < 3.12.4. Fixed in 3.12.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MoonShine is a web application framework designed for building administrative interfaces in PHP. It provides developers with tools to create and manage content easily. However, like many web applications, it can be vulnerable to security issues, particularly those related to user input handling. The vulnerability in question arises from improper sanitization of user inputs, specifically in the Create Article function.
Vulnerability Detail
A stored cross-site scripting (XSS) vulnerability exists in MoonShine version 3.12.3, allowing attackers to inject malicious scripts through the Link parameter. This can lead to unauthorized actions being performed on behalf of users, data theft, and other malicious activities. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation. Attackers can exploit this flaw to execute arbitrary web scripts or HTML in the context of the user's session.
How To Fix
Minimum fixed version
3.12.4
This is the first release that contains the fix.
composer require moonshine/moonshine:3.12.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization on the Link parameter to prevent the execution of malicious scripts. For example, you can use PHP's htmlspecialchars function to encode special characters: `
htmlspecialchars($link, ENT_QUOTES, 'UTF-8');
` This will help mitigate the risk until the package is updated.
Conclusion
The stored XSS vulnerability in MoonShine version 3.12.3 poses a significant risk to applications using this framework. It is crucial to update to version 3.12.4 or later to mitigate this risk. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for moonshine/moonshine →
FAQ
A stored XSS vulnerability allows attackers to inject malicious scripts into a web application, which are then stored and executed when users access the affected page.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to test your application without any signup.
The impacts can include unauthorized access to user accounts, data theft, and the ability to perform actions on behalf of users, leading to a loss of trust and potential legal ramifications.
Yes, you can implement input validation and sanitization on user inputs to prevent script execution until you can apply the update.
The CVSS score for this vulnerability is 4.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for moonshine/moonshine.
