CVE-2025-13180
📋 TL;DR
This CVE describes a basic cross-site scripting (XSS) vulnerability in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System. Attackers can inject malicious scripts via the first_name/last_name parameters in the /edit_profile endpoint, potentially compromising user sessions. Organizations using this inventory management software up to version 20250320 are affected.
💻 Affected Systems
- Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System
📦 What is this software?
Wholesale by Bdtask
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform account takeover, redirect users to malicious sites, or deface the application interface for all users.
Likely Case
Targeted attacks against specific users to steal credentials or session tokens, potentially leading to unauthorized access to inventory data.
If Mitigated
With proper input validation and output encoding, the attack would be prevented with minimal impact beyond failed exploitation attempts.
🎯 Exploit Status
The exploit requires authentication to access the /edit_profile endpoint, but the attack itself is simple to execute once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch is available. The vendor did not respond to disclosure attempts. Consider implementing workarounds or replacing the software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation and sanitization of first_name and last_name parameters to remove or encode HTML/JavaScript content.
Content Security Policy (CSP)
allImplement a strict Content Security Policy header to prevent execution of inline scripts and restrict script sources.
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with XSS protection rules to block malicious payloads.
- Restrict access to the /edit_profile endpoint to only trusted users or networks, and monitor for suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Test by submitting a basic XSS payload like <script>alert('XSS')</script> in the first_name or last_name fields of the edit profile form and check if it executes.Check Version:
Check the software version in the admin panel or configuration files; vulnerable versions are up to 20250320.Verify Fix Applied:
After implementing workarounds, retest with XSS payloads to ensure they are properly sanitized or blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual characters or script tags in first_name/last_name parameters in web server logs
- Multiple failed edit profile attempts with suspicious payloads
Network Indicators:
- HTTP requests to /edit_profile containing script tags or JavaScript code in parameters
SIEM Query:
source="web_logs" AND uri="/edit_profile" AND (param="first_name" OR param="last_name") AND (content="<script>" OR content="javascript:")