CVE-2025-10411
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into the E-Logbook with Health Monitoring System for COVID-19 1.0 through the profile_id parameter in check_profile.php. When exploited, it enables cross-site scripting attacks that can steal user sessions, redirect users, or deface the application. Organizations using this specific software version are affected.
💻 Affected Systems
- itsourcecode E-Logbook with Health Monitoring System for COVID-19
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator credentials, gain full system control, compromise sensitive health data, and pivot to internal networks.
Likely Case
Attackers hijack user sessions, redirect users to malicious sites, or deface the application interface.
If Mitigated
Proper input validation and output encoding prevent script execution, limiting impact to failed attack attempts.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers with basic web skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: UNKNOWN
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
PHPImplement server-side validation and sanitization of the profile_id parameter to remove or encode script tags.
Implement PHP filter_var() with FILTER_SANITIZE_STRING or htmlspecialchars() on profile_id input
Web Application Firewall (WAF)
allDeploy a WAF with XSS protection rules to block malicious payloads targeting the check_profile.php endpoint.
Configure WAF rules to detect and block script tags in POST parameters to /stc-log-keeper/check_profile.php
🧯 If You Can't Patch
- Disable or restrict access to /stc-log-keeper/check_profile.php if not essential
- Implement Content Security Policy (CSP) headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Test by submitting a script payload like <script>alert('XSS')</script> in the profile_id parameter to check_profile.php and observe if it executes.Check Version:
Check application documentation or source code for version information; typically found in README files or configuration files.Verify Fix Applied:
After implementing fixes, repeat the test payload and verify no script execution occurs; check that input is properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /stc-log-keeper/check_profile.php with script tags or encoded payloads in profile_id
- Multiple failed login attempts following XSS payload submissions
Network Indicators:
- HTTP traffic containing <script> tags or JavaScript in POST parameters
- Requests to known malicious domains from the application server
SIEM Query:
source="web_server_logs" AND uri="/stc-log-keeper/check_profile.php" AND (param="profile_id" AND value MATCHES "<script.*>.*</script>" OR "javascript:")