CVE-2025-15052
📋 TL;DR
This stored cross-site scripting (XSS) vulnerability in code-projects Student Information System 1.0 allows attackers to inject malicious scripts into firstname/lastname fields in profile.php. When other users view affected profiles, the scripts execute in their browsers. All users of Student Information System 1.0 are affected.
💻 Affected Systems
- code-projects Student Information System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, perform actions as authenticated users, or install malware via drive-by downloads.
Likely Case
Session hijacking, credential theft, defacement of user profiles, or redirection to phishing pages.
If Mitigated
With proper input validation and output encoding, the risk is reduced to minimal, though the vulnerability still exists in the codebase.
🎯 Exploit Status
Exploit requires user interaction (viewing a malicious profile) but the payload injection is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider applying input validation and output encoding to profile.php firstname/lastname fields.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to sanitize firstname and lastname inputs in profile.php
Edit profile.php to include: htmlspecialchars($_POST['firstname'], ENT_QUOTES, 'UTF-8'); and similar for lastname
Content Security Policy
allImplement CSP headers to restrict script execution
Add header: Content-Security-Policy: default-src 'self'; script-src 'self'
🧯 If You Can't Patch
- Disable user profile viewing functionality
- Implement web application firewall (WAF) rules to block XSS payloads
🔍 How to Verify
Check if Vulnerable:
Test by entering <script>alert('XSS')</script> in firstname/lastname fields and check if script executes when viewing profileCheck Version:
Check system documentation or configuration files for version informationVerify Fix Applied:
After applying fixes, test with same payload to confirm script does not execute📡 Detection & Monitoring
Log Indicators:
- Unusual script tags or JavaScript in firstname/lastname fields in access logs
- Multiple failed login attempts after profile views
Network Indicators:
- Outbound connections to unknown domains after profile page loads
- Suspicious JavaScript in HTTP POST requests to profile.php
SIEM Query:
source="web_logs" AND (uri="/profile.php" AND (message="*<script>*" OR message="*javascript:*"))