CVE-2025-62731
📋 TL;DR
SOPlanning's public holidays feature contains a stored cross-site scripting vulnerability that allows attackers with access to the feature to inject malicious HTML/JavaScript. When users view affected pages, the injected code executes in their browsers. Only administrators and privileged users can exploit this by default.
💻 Affected Systems
- SOPlanning
📦 What is this software?
Soplanning by Soplanning
⚠️ Risk & Real-World Impact
Worst Case
Privileged attacker steals administrator credentials, takes over admin accounts, and compromises the entire SOPlanning instance and connected systems.
Likely Case
Privileged user performs session hijacking against other users, steals sensitive data, or defaces the application.
If Mitigated
Limited to authenticated users with holiday management privileges causing minor data exposure or UI manipulation.
🎯 Exploit Status
Requires authenticated access to /feries endpoint with holiday management privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.55
Vendor Advisory: https://www.soplanning.org/en/
Restart Required: Yes
Instructions:
1. Backup your SOPlanning instance and database. 2. Download version 1.55 from official website. 3. Replace existing files with new version. 4. Restart web server. 5. Verify functionality.
🔧 Temporary Workarounds
Restrict holiday management access
allRemove public holidays management permissions from all non-essential users
Web Application Firewall rules
allImplement WAF rules to block XSS payloads targeting /feries endpoint
🧯 If You Can't Patch
- Implement strict Content Security Policy headers to block inline JavaScript execution
- Enable input validation and output encoding for all user-controlled data in holiday management features
🔍 How to Verify
Check if Vulnerable:
Check if SOPlanning version is below 1.55 and test /feries endpoint with XSS payloads in holiday data fieldsCheck Version:
Check SOPlanning interface footer or admin panel for version numberVerify Fix Applied:
After upgrading to 1.55, attempt to inject XSS payloads in holiday fields and verify they are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /feries endpoint with script tags or JavaScript code
- Multiple failed login attempts followed by holiday management access
Network Indicators:
- HTTP requests containing malicious script payloads in holiday-related parameters
SIEM Query:
source="web_server" AND (uri="/feries" AND (body="<script>" OR body="javascript:"))