CVE-2025-9845
BaseFortify
Publication date: 2025-09-03
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| carmelo | fruit_shop_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-9845 is a stored Cross-Site Scripting (XSS) vulnerability in the Fruit Shop Management System version 1.0, specifically in the products.php file. It occurs because user-controllable inputs such as product_code, gen_name, product_name, and supplier are not properly neutralized or escaped before being displayed on the web page. This allows attackers to inject malicious JavaScript code that is stored in the database and executed in the browsers of users who visit the affected page, potentially compromising data integrity and user security. [1, 2]
How can this vulnerability impact me? :
This vulnerability can lead to several security impacts including session hijacking, theft of sensitive information like cookies and login credentials, phishing attacks through forged forms, and unauthorized administrative actions such as tampering with or deleting product data. Since the malicious scripts execute in the context of other users, including administrators, it can compromise the integrity and security of the system and its data. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the products.php page of the Fruit Shop Management System is vulnerable to stored XSS by injecting test scripts into the input fields such as product_code, gen_name, product_name, or supplier via the product addition or editing pages. A proof-of-concept involves submitting a payload like `<script>alert('XSS')</script>` in these fields and then revisiting products.php to see if the script executes. Additionally, vulnerable targets can be identified using Google dorking with the query `inurl:products.php` to find exposed instances. There are no specific network commands provided, but manual testing of input fields and web page output is recommended. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying output encoding on all user-controllable data retrieved from the database before rendering it in HTML, using PHP's `htmlspecialchars()` function to escape special characters. Enforce strict input validation on product addition and editing pages by restricting special characters such as `<`, `>`, and the word `script` through a whitelist approach. Implement a global filtering mechanism by encapsulating a universal output filtering function (e.g., `escape_output()`) to consistently sanitize all dynamic content output. If possible, replace the affected product with an alternative as no known countermeasures or patches are currently available. [1, 2]