CVE-2025-62729
📋 TL;DR
SOPlanning web application is vulnerable to stored cross-site scripting (XSS) in the /status endpoint. An authenticated attacker can inject malicious HTML and JavaScript that executes when other users view affected pages. This affects all SOPlanning instances running vulnerable versions.
💻 Affected Systems
- SOPlanning
📦 What is this software?
Soplanning by Soplanning
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or deploy malware to users' browsers.
Likely Case
Session hijacking, credential theft, or defacement of the application interface for users viewing the compromised status pages.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, though stored XSS remains dangerous.
🎯 Exploit Status
Exploitation requires authenticated access; stored XSS payloads are simple to craft.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.55
Vendor Advisory: https://www.soplanning.org/en/
Restart Required: Yes
Instructions:
1. Backup current SOPlanning installation and database. 2. Download version 1.55 from official website. 3. Replace existing files with new version. 4. Restart web server. 5. Verify functionality.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize HTML/JS in status endpoint parameters
Modify /status endpoint code to sanitize user input using HTML entity encoding
Content Security Policy
allImplement CSP headers to restrict script execution
Add header: Content-Security-Policy: script-src 'self'
🧯 If You Can't Patch
- Restrict access to /status endpoint to trusted users only
- Implement web application firewall (WAF) rules to block XSS payloads
🔍 How to Verify
Check if Vulnerable:
Check SOPlanning version in admin panel or via version file; if <1.55, vulnerableCheck Version:
Check admin dashboard or view source for version informationVerify Fix Applied:
Test /status endpoint with basic XSS payloads like <script>alert('test')</script> and verify it's properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /status endpoint with script tags or JavaScript code
- Multiple failed login attempts followed by status updates
Network Indicators:
- HTTP requests containing script tags or JavaScript in POST parameters to /status
SIEM Query:
source="web_server" AND uri_path="/status" AND (request_body CONTAINS "<script>" OR request_body CONTAINS "javascript:")