CVE-2025-61998
📋 TL;DR
This vulnerability allows administrative users in OPEXUS FOIAXpress to inject malicious JavaScript or content into the Technical Support Hyperlink Manager. When other users click these links, the injected content executes in their context, potentially enabling session hijacking, credential theft, or unauthorized actions. Only FOIAXpress installations before version 11.13.3.0 are affected.
💻 Affected Systems
- OPEXUS FOIAXpress
📦 What is this software?
Foiaxpress by Opexustech
⚠️ Risk & Real-World Impact
Worst Case
Administrative user compromises other user accounts, steals sensitive data, performs unauthorized actions on behalf of victims, and potentially gains persistent access to the system.
Likely Case
Malicious or compromised admin injects JavaScript to steal session cookies or credentials from other users, leading to unauthorized access and potential data exfiltration.
If Mitigated
With proper access controls and monitoring, impact is limited to isolated incidents that can be quickly detected and contained.
🎯 Exploit Status
Exploitation requires administrative privileges to inject malicious content. The attack then relies on other users clicking the malicious links.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.13.3.0
Vendor Advisory: https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.3.0.pdf
Restart Required: No
Instructions:
1. Download FOIAXpress version 11.13.3.0 or later from OPEXUS. 2. Follow standard upgrade procedures per OPEXUS documentation. 3. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Restrict Administrative Access
allLimit administrative privileges to only trusted personnel who require access to the Technical Support Hyperlink Manager.
User Education
allTrain users to be cautious when clicking links, especially those that appear suspicious or unexpected.
🧯 If You Can't Patch
- Implement strict monitoring of administrative actions in the Technical Support Hyperlink Manager.
- Apply principle of least privilege and review all administrative user accounts for necessity.
🔍 How to Verify
Check if Vulnerable:
Check FOIAXpress version in application settings or administrative console. If version is below 11.13.3.0, the system is vulnerable.Check Version:
Check within FOIAXpress administrative interface under Help > About or similar version information section.Verify Fix Applied:
Confirm the installed version is 11.13.3.0 or higher via the application's version information.📡 Detection & Monitoring
Log Indicators:
- Unusual administrative activity in Technical Support Hyperlink Manager
- Multiple users accessing suspicious URLs from the same hyperlink
Network Indicators:
- Outbound connections to unexpected domains following hyperlink clicks
- Unusual data exfiltration patterns
SIEM Query:
source="foiaxpress" AND (event_type="hyperlink_modification" OR url_contains="javascript:")