CERT Polska disclosed eight vulnerabilities in Windu CMS 4.1, including CSRF, broken…
CERT Polska disclosed eight vulnerabilities in Windu CMS 4.1, including CSRF, broken access control, XSS, and authentication bypass flaws—all patched in build 2250.
CERT Polska coordinated disclosure of eight vulnerabilities affecting Windu CMS version 4.1, following a responsible disclosure report from researcher Karol Czubernat. The vulnerabilities span multiple categories including Cross-Site Request Forgery (CSRF) flaws in user editing and file upload functions, broken access control allowing unauthorized deletion of Super Admin accounts, and multiple stored Cross-Site Scripting (XSS) issues. Additional weaknesses include client-side brute-force protection that can be trivially bypassed and user enumeration during authentication.
The most severe issues enable attackers to manipulate administrative accounts through CSRF attacks—bypassing token validation by reusing tokens from other users, deleting Super Admin accounts via direct GET requests, and forcing administrators to delete users or upload malicious files by visiting attacker-controlled websites. The stored XSS vulnerabilities allow privilege escalation where lower-privileged users can inject malicious scripts that execute when administrators view logs or edit pages.
All identified vulnerabilities were patched in Windu CMS version 4.1 build 2250. Organizations running earlier builds of version 4.1 should update immediately. The vendor has been responsive throughout the coordinated disclosure process.
Mentioned in this report
Detection guidance
Windu CMS Admin Account Deletion via Cross-Site GET Request
Detects a GET request to a CMS admin user-deletion endpoint carrying a cross-site (external) Referer header, consistent with the disclosed CSRF flaw that lets an attacker delete Super Admin accounts by luring an authenticated admin to a malicious page. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Windu CMS Admin Account Deletion via Cross-Site GET Request
id: 1df83119-d0a0-577a-8c32-f0f70b6d613d
status: experimental
description: Detects GET requests to an admin user/account deletion endpoint where
the Referer header points to an external/attacker-controlled domain, matching the
CSRF-based Super Admin deletion vulnerability disclosed for Windu CMS.
references:
- CERT Polska Windu CMS 4.1 disclosure
logsource:
category: webserver
detection:
selection:
cs-method: GET
cs-uri-query|contains:
- action=delete
- delete_user
- del_admin
filter_internal_referer:
cs-referrer|contains:
- ://localhost
- ://127.0.0.1
- .internal
condition: selection and not filter_internal_referer
fields:
- cs-uri-query
- cs-referrer
- c-ip
- cs-username
falsepositives:
- Legitimate admin bookmarklets or browser extensions that call the delete endpoint
directly
- Internal automation/testing tools issuing direct GET calls to the admin API
level: high
tags:
- attack.t1190
- attack.t1078
author: Vorant
Repeated Failed CMS Admin Login Attempts (Client-Side Brute-Force Bypass)
Detects a pattern of repeated failed authentication requests against a CMS login endpoint from a single source, indicating brute-force attempts against accounts where client-side lockout protections can be trivially bypassed (e.g., by disabling JavaScript or replaying requests directly). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Repeated Failed CMS Admin Login Attempts (Client-Side Brute-Force Bypass)
id: 07098d91-4211-5880-bdf9-148ae153cc0a
status: experimental
description: Detects multiple failed login POST requests to the CMS authentication
endpoint from the same source, consistent with brute-force or credential-stuffing
attempts bypassing weak client-side lockout controls. Threshold/time-window correlation
(e.g., more than 10 failed attempts within 5 minutes from one IP) should be enforced
in the SIEM correlation layer, not in this rule's condition.
references:
- CERT Polska Windu CMS 4.1 disclosure
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-query|contains:
- /login
- /admin/login
- auth
sc-status:
- 401
- 403
condition: selection
fields:
- c-ip
- cs-username
- sc-status
- cs-uri-query
falsepositives:
- Legitimate users mistyping credentials repeatedly
- Automated uptime/health-check monitors hitting the login endpoint
level: medium
tags:
- attack.t1110
- attack.t1078
author: Vorant
Stored XSS Payload Submitted via CMS Input Fields
Detects HTTP requests carrying script-injection payloads (script tags, javascript: URIs, event handlers) in CMS form parameters such as log entries or page edit fields, consistent with the stored XSS vulnerabilities disclosed for Windu CMS that trigger when an admin views logs or edits pages. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Stored XSS Payload Submitted via CMS Input Fields
id: 5d2a5018-088f-583e-a779-c1d748fe1d05
status: experimental
description: Detects request bodies/query strings containing common script-injection
markers submitted to CMS content, log, or page-edit endpoints, matching the stored
XSS pattern disclosed in Windu CMS where low-privileged input is later rendered
for admins.
references:
- CERT Polska Windu CMS 4.1 disclosure
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-query|contains:
- /log
- /edit
- /page
- /comment
selection_payload:
cs-uri-query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- '%3Cscript'
condition: selection_endpoint and selection_payload
fields:
- cs-uri-query
- c-ip
- cs-username
falsepositives:
- Security scanners or penetration testers probing the CMS for XSS
- Legitimate content containing code snippets that include the word script or onload
as documentation text
level: high
tags:
- attack.t1059.007
- attack.t1190
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/11/CVE-2025-59110
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free