CVE-2025-15170
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into Advaya Softech GEMS ERP Portal error messages, which are then executed in users' browsers. It affects all versions up to 2.1 of the GEMS ERP Portal. The attack can be performed remotely without authentication.
💻 Affected Systems
- Advaya Softech GEMS ERP Portal
📦 What is this software?
Gems Erp Portal by Advayasoftech
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, perform actions on behalf of authenticated users, or deploy malware through the ERP portal.
Likely Case
Session hijacking, credential theft, or defacement of the portal interface through malicious script execution.
If Mitigated
Limited to UI manipulation with proper input validation and output encoding in place.
🎯 Exploit Status
Public proof-of-concept video available. Attack requires no authentication and minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor has not responded to disclosure. Consider upgrading if vendor releases patched version.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize the 'Message' parameter
Implement input validation in /home.jsp to strip or encode script tags
WAF Rule
allDeploy web application firewall rules to block XSS payloads in the Message parameter
Configure WAF to detect and block script tags, javascript:, and other XSS patterns in URL parameters
🧯 If You Can't Patch
- Block access to /home.jsp?isError=true endpoint at network perimeter
- Implement Content Security Policy headers to restrict script execution
🔍 How to Verify
Check if Vulnerable:
Test by injecting <script>alert('XSS')</script> into the Message parameter of /home.jsp?isError=trueCheck Version:
Check GEMS ERP Portal version in application interface or configuration filesVerify Fix Applied:
Verify that script injection attempts are properly sanitized and do not execute in browser📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /home.jsp?isError=true with script tags or javascript: in parameters
- Multiple error page requests with similar patterns
Network Indicators:
- HTTP requests containing <script>, javascript:, or other XSS patterns in URL parameters
SIEM Query:
source="web_logs" AND uri_path="/home.jsp" AND query_string="*isError=true*" AND (query_string="*<script>*" OR query_string="*javascript:*")