CVE-2025-47204

Vulnerability

Overview

CVE-2025-47204 affects bootstrap-multiselect version 1.1.2, specifically the file post.php. The issue is that this PHP script echoes back arbitrary POST data without sanitization or validation. If a developer adopts this script's structure wholesale in a production web application, it introduces a reflective Cross-Site Scripting (XSS) vulnerability [1][2][3].

Exploitation

Prerequisites

The attack surface is limited: the vulnerable post.php script is part of the library's source code examples, not the core widget logic. For exploitation to be possible, a developer must have copied the pattern from post.php into an actual deployed endpoint that echoes unsanitized POST parameters. In that scenario, an attacker could craft a request with malicious JavaScript in a POST parameter. Furthermore, because no CSRF token or origin check is present, the XSS can be triggered via Cross-Site Request Forgery (CSRF) [3], meaning an external site can force a victim's browser to submit the malicious POST request.

Impact

If successfully exploited, the attacker can execute arbitrary JavaScript in the victim's browser session within the context of the vulnerable application. This can lead to session hijacking, data theft, or defacement. The severity depends on the sensitivity of the application using the vulnerable pattern.

Mitigation

Status

The vendor has acknowledged the issue via GitHub [1][2]. The library has since released newer versions (e.g., v2.0.0), but the fix is not explicitly described as addressing this CVE. Users are advised to avoid copying the post.php pattern in production, or to sanitize all POST data before echoing. As of this writing, the CVE has not been added to the CISA Known Exploited Vulnerabilities catalog [3].