CVE-2025-14221
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into the First Name/Last Name fields of SourceCodester Online Banking System 1.0, enabling cross-site scripting attacks. The vulnerability affects all users of this specific banking system version and can be exploited remotely without authentication.
💻 Affected Systems
- SourceCodester Online Banking System
📦 What is this software?
Banking System by Oretnom23
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal user session cookies, redirect users to malicious sites, or perform actions on behalf of authenticated users, potentially leading to account takeover and financial fraud.
Likely Case
Attackers will likely use this to steal session cookies and hijack user accounts, potentially accessing banking information and performing unauthorized transactions.
If Mitigated
With proper input validation and output encoding, the risk is reduced to minimal, though the vulnerable endpoint remains exposed.
🎯 Exploit Status
The exploit is publicly available and requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and output encoding as a temporary fix.
🔧 Temporary Workarounds
Implement Input Validation
allAdd server-side validation to sanitize First Name and Last Name inputs, rejecting or encoding special characters.
Enable Content Security Policy
allImplement CSP headers to restrict script execution from unauthorized sources.
🧯 If You Can't Patch
- Deploy a Web Application Firewall (WAF) with XSS protection rules
- Restrict access to the vulnerable endpoint using network segmentation or authentication
🔍 How to Verify
Check if Vulnerable:
Test the /?page=user endpoint by injecting script payloads into First Name/Last Name parameters and checking if they execute.Check Version:
Check the application's version in its configuration files or admin panel.Verify Fix Applied:
Verify that script injections in First Name/Last Name fields are properly sanitized and do not execute in the browser.📡 Detection & Monitoring
Log Indicators:
- Unusual length or special characters in First Name/Last Name parameters in web server logs
Network Indicators:
- HTTP requests to /?page=user with script tags or JavaScript in parameters
SIEM Query:
source="web_server" AND uri="/?page=user" AND (param="First Name" OR param="Last Name") AND (value CONTAINS "<script>" OR value CONTAINS "javascript:")