CVE-2025-10386
BaseFortify
Publication date: 2025-09-14
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yida | ecms_consulting_enterprise_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-10386 is a reflected Cross-Site Scripting (XSS) vulnerability in Yida ECMS Consulting Enterprise Management System version 1.0, specifically in the /login.do endpoint's POST request handler. The vulnerability arises from insufficient input sanitization of the 'requestUrl' parameter, allowing an attacker to inject arbitrary JavaScript code. This malicious script is reflected in the server's response and executed in the victim's browser context, typically triggered by user interactions such as mouse hover. Exploitation does not require authentication and can be performed remotely. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute malicious scripts in the context of a victim's browser, potentially leading to session hijacking, credential theft, phishing attacks, or unauthorized actions performed on behalf of authenticated users. Since the attack can be launched remotely without authentication, it poses a significant risk to users interacting with the affected system. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending crafted POST requests to the /login.do endpoint with malicious payloads in the requestUrl parameter and observing if the input is reflected unsanitized in the response, indicating a reflected XSS flaw. For example, you can use curl to test this: curl -X POST -d 'requestUrl=><a oNmOuseovEr+=(confirm)()>' http://target/login.do and check if the response contains the injected script. Monitoring web server logs for suspicious POST requests containing script tags or unusual characters in the requestUrl parameter can also help detect exploitation attempts. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Implement server-side input sanitization by validating and rejecting inputs to the requestUrl parameter that contain HTML or JavaScript syntax such as <, >, and event handlers (e.g., on*). Use a whitelist approach allowing only safe characters like alphanumerics, @, and .; 2) Apply output encoding to user-controlled data before rendering it in HTML, converting special characters to their HTML entities (e.g., < to <, > to >, " to "); 3) Deploy a strict Content Security Policy (CSP) header to restrict script execution, for example: Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; style-src 'self'; 4) Consider replacing the affected product as no official patches or fixes are available. [2, 3]