CVE-2025-7767
BaseFortify
Publication date: 2025-07-18
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| phpgurukul | art_gallery_management_system | 1.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-7767 is a stored Cross-Site Scripting (XSS) vulnerability in PHPGurukul Art Gallery Management System version 1.1, specifically in the /admin/edit-art-medium-detail.php file. It occurs because the 'artmed' parameter is not properly validated or encoded before being included in the webpage output. This allows attackers to inject malicious JavaScript code that is stored and executed within the context of the affected page when viewed by users. [1, 2, 3]
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to severe security consequences such as session hijacking, theft of sensitive information including login credentials, unauthorized actions performed on behalf of authenticated users, and manipulation of webpage content or appearance. Attackers can remotely inject and execute malicious scripts, compromising the integrity and security of the application and its users. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by identifying the presence of the vulnerable page "/admin/edit-art-medium-detail.php" and testing the "artmed" parameter for stored cross-site scripting (XSS). One method is to use Google dorking with the query: inurl:admin/edit-art-medium-detail.php to find potentially vulnerable targets. To test the vulnerability, you can send crafted POST requests injecting XSS payloads such as `<img src=x onerror=alert(1)>` into the "artmed" parameter and observe if the script executes when the page is loaded. Example command using curl to test injection: curl -X POST -d "artmed=<img src=x onerror=alert(1)>" https://targetsite.com/admin/edit-art-medium-detail.php Monitoring web traffic for suspicious scripts or unexpected JavaScript execution in this page can also help detect exploitation attempts. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: - Implement proper output encoding of the "artmed" parameter before rendering it in the HTML page to prevent script execution. - Enforce strict input validation and sanitization on both client and server sides to ensure only expected input formats are accepted. - Deploy a strict Content Security Policy (CSP) to restrict the sources of executable scripts and reduce the risk of XSS. - Use HttpOnly flags on session cookies to prevent access via JavaScript, mitigating session hijacking risks. - If possible, replace the affected PHPGurukul Art Gallery Management System version 1.1 with an alternative solution that is not vulnerable. These steps are critical to protect system integrity and user privacy from exploitation of this stored XSS vulnerability. [1, 2, 3]