CVE-2025-40694
📋 TL;DR
This stored cross-site scripting vulnerability in Online Fire Reporting System v1.2 allows authenticated attackers to inject malicious scripts via date parameters. When exploited, it can steal authenticated users' session cookies, potentially leading to account takeover. Only systems running the vulnerable PHPGurukul software are affected.
💻 Affected Systems
- PHPGurukul Online Fire Reporting System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access by stealing admin session cookies, potentially compromising the entire system and sensitive fire reporting data.
Likely Case
Attackers steal user session cookies to hijack accounts, manipulate fire reporting data, or perform unauthorized actions within the system.
If Mitigated
With proper input validation and output encoding, the malicious scripts would be neutralized, preventing session theft.
🎯 Exploit Status
Requires authenticated access and social engineering to deliver payload to victims.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - check vendor for updates
Vendor Advisory: https://www.phpgurukul.com/
Restart Required: No
Instructions:
1. Contact PHPGurukul for patched version 2. Update to latest version 3. Apply input validation to 'fromdate' and 'todate' parameters
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to only accept valid date formats for 'fromdate' and 'todate' parameters
Implement PHP filter: if(!preg_match('/^\d{4}-\d{2}-\d{2}$/', $_POST['fromdate'])) { die('Invalid date format'); }
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads in POST parameters
- Add Content Security Policy headers to restrict script execution
🔍 How to Verify
Check if Vulnerable:
Test by submitting <script>alert('XSS')</script> as 'fromdate' or 'todate' parameter to /ofrs/admin/bwdates-report-result.phpCheck Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
Verify that script tags in date parameters are properly sanitized or rejected📡 Detection & Monitoring
Log Indicators:
- POST requests to bwdates-report-result.php with script tags or JavaScript in parameters
- Unusual date format submissions
Network Indicators:
- HTTP POST requests containing script payloads in date fields
SIEM Query:
source="web_logs" AND uri="*bwdates-report-result.php*" AND (param="*<script>*" OR param="*javascript:*")