CVE-2025-61999
📋 TL;DR
OPEXUS FOIAXpress versions before 11.13.3.0 contain a stored cross-site scripting (XSS) vulnerability where administrative users can upload malicious SVG images containing JavaScript. When other users view pages displaying these images, the embedded code executes in their browser context, potentially allowing session hijacking or credential theft. This affects all organizations using vulnerable versions of FOIAXpress.
💻 Affected Systems
- OPEXUS FOIAXpress
📦 What is this software?
Foiaxpress by Opexustech
⚠️ Risk & Real-World Impact
Worst Case
Administrative user with malicious intent steals session cookies and credentials from all other users, gains full system access, exfiltrates sensitive FOIA data, and maintains persistent access.
Likely Case
Privileged insider or compromised admin account performs targeted session hijacking against specific users to access sensitive FOIA records and personal data.
If Mitigated
Limited impact due to strong access controls, admin user monitoring, and content security policies preventing successful exploitation.
🎯 Exploit Status
Requires administrative access to upload malicious SVG files. Exploitation is straightforward once admin access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.13.3.0
Vendor Advisory: https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.3.0.pdf
Restart Required: No
Instructions:
1. Download FOIAXpress version 11.13.3.0 from OPEXUS support portal. 2. Backup current installation and database. 3. Run the upgrade installer following vendor documentation. 4. Verify successful upgrade by checking version number.
🔧 Temporary Workarounds
Restrict SVG Uploads
allConfigure web application firewall or server rules to block SVG file uploads to FOIAXpress.
Implement Content Security Policy
webAdd CSP headers to prevent inline script execution from uploaded images.
Content-Security-Policy: script-src 'self'
🧯 If You Can't Patch
- Implement strict admin user monitoring and review all SVG uploads
- Disable logo upload functionality entirely in administrative settings
🔍 How to Verify
Check if Vulnerable:
Check FOIAXpress version in administrative console. If version is below 11.13.3.0, system is vulnerable.Check Version:
Check Help > About in FOIAXpress administrative interfaceVerify Fix Applied:
After patching, verify version shows 11.13.3.0 or higher in administrative console.📡 Detection & Monitoring
Log Indicators:
- Unusual SVG file uploads by admin users
- Multiple failed login attempts followed by SVG upload
Network Indicators:
- Outbound connections to unknown domains following SVG file access
SIEM Query:
source="foiaxpress" AND (event="file_upload" AND file_extension=".svg")