CVE-2025-10485

The vulnerability resides in the ppt_log function within the /login endpoint of h3blog. The application records user operation logs, including the IP address obtained from the X-Forwarded-For header via get_real_ip(), without proper sanitization. An attacker can craft a login request with a malicious script in the X-Forwarded-For header, which is then stored in the log and executed when an administrator views the logs [1].

To exploit this, an attacker sends a POST request to /login with a forged X-Forwarded-For header containing JavaScript payload. The attack requires no authentication and can be performed remotely, as the endpoint is publicly accessible. The injected script runs in the context of the administrator's browser session [1].

Successful exploitation leads to stored cross-site scripting (XSS), allowing the attacker to steal cookies, session tokens, or other sensitive information, or perform actions on behalf of the administrator. This could compromise the entire application's security [1].

As of the publication date, the vendor uses a rolling release system, and no specific version information for patches is disclosed. Users should monitor for updates and consider input validation on the X-Forwarded-For header as a workaround until a fix is available.