CVE-2025-9440
BaseFortify
Publication date: 2025-08-26
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| 1000projects | online_student_project_report_submission_and_evaluation_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the /rse/admin/add_title.php endpoint for improper handling of the 'title' parameter. A common detection method is to send a POST request with a payload such as <script>alert('XSS')</script> in the 'title' parameter and observe if the script executes or is reflected in the response without proper encoding. Additionally, Google dorking with the query inurl:admin/add_title.php can help identify vulnerable targets. Example command using curl to test the vulnerability: curl -X POST -d "batch=2019&title=<script>alert('XSS')</script>&desc=111&add=add" http://target-site/rse/admin/add_title.php [1, 2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Implement output encoding to properly encode user inputs based on context (HTML, JavaScript, CSS, URL) to prevent execution as code. 2) Enforce strict input validation and filtering to accept only expected input formats and sanitize or reject potentially malicious content such as script tags or event handlers. 3) Implement a strict Content Security Policy (CSP) to restrict script sources and block unauthorized inline or external scripts. 4) Set HttpOnly and Secure flags on sensitive cookies to prevent JavaScript access and ensure transmission only over HTTPS. 5) Conduct regular security audits and code reviews to detect and remediate XSS and other vulnerabilities promptly. [1, 3]
Can you explain this vulnerability to me?
CVE-2025-9440 is a Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Online Project Report Submission and Evaluation System, specifically in the /rse/admin/add_title.php file. The vulnerability occurs because the application improperly handles the 'title' parameter by outputting user input directly to the web page without proper encoding or filtering. This allows attackers to inject and execute arbitrary JavaScript code in the browsers of users who visit the affected page. Exploitation requires no authentication and can be performed remotely. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can lead to several harmful impacts including theft of cookies, session tokens, or other sensitive information, unauthorized actions performed on behalf of the victim, defacement of web pages, redirection of users to malicious websites, and potentially full control over the victim's browser. These impacts compromise user privacy and system security, allowing attackers to hijack sessions or manipulate the affected system remotely without authentication. [1, 2, 3]