CVE-2025-14580
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in Qualitor's document viewing component that allows attackers to inject malicious scripts via the cdscript parameter. The vulnerability affects Qualitor installations up to version 8.24.73 and can be exploited remotely without authentication. Organizations using vulnerable versions of Qualitor are at risk of client-side attacks against their users.
💻 Affected Systems
- Qualitor
📦 What is this software?
Qualitor by Qualitor
Qualitor by Qualitor
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, perform actions on behalf of authenticated users, or deliver malware to end users.
Likely Case
Attackers inject malicious JavaScript to steal session tokens or credentials from authenticated users, potentially leading to account compromise.
If Mitigated
With proper input validation and output encoding, the attack would fail to execute malicious scripts, limiting impact to benign parameter manipulation.
🎯 Exploit Status
Exploit details have been publicly disclosed and the vulnerability requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 8.24.73
Vendor Advisory: Not provided in CVE details
Restart Required: No
Instructions:
1. Contact Qualitor vendor for updated versions containing the fix. 2. Upgrade to version after 8.24.73. 3. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block malicious script injection in the cdscript parameter
Input Validation Filter
allAdd server-side validation to sanitize the cdscript parameter before processing
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to prevent script execution
- Restrict access to the vulnerable endpoint using network segmentation or authentication requirements
🔍 How to Verify
Check if Vulnerable:
Test the /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php endpoint with XSS payloads in the cdscript parameterCheck Version:
Check Qualitor version in administration panel or configuration filesVerify Fix Applied:
After patching, test the same endpoint with XSS payloads to confirm they are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual parameter values in cdscript parameter containing script tags or JavaScript code
- Multiple failed XSS attempts
Network Indicators:
- HTTP requests to viewDocumento.php with suspicious cdscript parameter values
SIEM Query:
source="web_server" AND uri="*viewDocumento.php*" AND (param="*<script>*" OR param="*javascript:*" OR param="*onload=*" OR param="*onerror=*")