CVE-2025-62296
📋 TL;DR
SOPlanning versions before 1.55 contain a stored cross-site scripting (XSS) vulnerability in the /taches endpoint. Attackers with medium privileges can inject malicious HTML and JavaScript that executes when users open the editor, potentially compromising user sessions or performing unauthorized actions. This affects all SOPlanning deployments using vulnerable versions.
💻 Affected Systems
- SOPlanning
📦 What is this software?
Soplanning by Soplanning
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, hijack user sessions, deface the application, or redirect users to malicious sites, potentially leading to full system compromise.
Likely Case
Attackers with medium privileges steal session cookies or credentials from other users, gaining unauthorized access to sensitive planning data.
If Mitigated
With proper input validation and output encoding, the attack would fail to execute malicious scripts, limiting impact to data integrity issues.
🎯 Exploit Status
Stored XSS vulnerabilities are commonly exploited; requires authenticated access with medium privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.55
Vendor Advisory: https://www.soplanning.org/en/
Restart Required: Yes
Instructions:
1. Backup your SOPlanning installation and database. 2. Download version 1.55 from the official SOPlanning website. 3. Replace the existing installation files with the new version. 4. Restart your web server. 5. Verify the update was successful.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize HTML/JS in task data
Implement input sanitization in /taches endpoint code
Content Security Policy
allImplement CSP headers to restrict script execution
Add 'Content-Security-Policy: script-src 'self'' to HTTP headers
🧯 If You Can't Patch
- Restrict user privileges to minimum necessary, especially for /taches endpoint access
- Implement web application firewall (WAF) rules to block XSS payloads
🔍 How to Verify
Check if Vulnerable:
Check if SOPlanning version is below 1.55 in admin panel or by examining version filesCheck Version:
Check admin panel or examine includes/version.php fileVerify Fix Applied:
After updating to 1.55, test XSS payloads in /taches endpoint to confirm they are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual HTML/JS patterns in task creation/modification logs
- Multiple failed XSS attempts in web server logs
Network Indicators:
- HTTP POST requests to /taches with script tags or JavaScript code
SIEM Query:
source="web_server" AND (uri="/taches" AND (body CONTAINS "<script>" OR body CONTAINS "javascript:"))