CVE-2025-51397
BaseFortify
Publication date: 2025-07-21
Last updated on: 2025-08-07
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| livehelperchat | live_helper_chat | to 4.61 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-779 | The product logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stored Cross-Site Scripting (XSS) flaw in the Facebook Chat module of Live Helper Chat (up to version 4.61). It allows an attacker, logged in as an operator, to inject malicious JavaScript code into the Operator Surname field. This malicious code is stored persistently and executed when an administrator or user with higher privileges views the Recipients List, enabling arbitrary script execution in the victim's browser. [1]
How can this vulnerability impact me? :
The vulnerability can lead to execution of arbitrary scripts in the context of the victim's browser, which may result in session hijacking, data theft, or other malicious actions compromising user accounts and sensitive information. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the Operator Surname field in the Live Helper Chat application contains suspicious or crafted payloads such as HTML or JavaScript code (e.g., `"><img src=\"x\" onerror=\"prompt(1);\">`). Detection involves reviewing the Recipients List for such injected scripts. Since the vulnerability is stored XSS, manual inspection or automated scanning of the Surname parameter for script tags or event handlers can help identify exploitation. No specific network commands are provided, but inspecting the database or application input fields for malicious payloads is recommended. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Live Helper Chat to version 4.61 or later, where the vulnerability has been fixed. Additionally, restrict operator input validation to prevent injection of HTML or JavaScript in the Surname field, and review user privileges to limit exposure. Monitoring and sanitizing inputs can also help reduce risk until the patch is applied. [1]