Executive Summary

CVE-2025-12229 is a persistent cross-site scripting (XSS) vulnerability in projectworlds Expense Management System version 1.0, specifically in the Roles Page component at /public/admin/roles/create. It occurs because user input is not properly sanitized before being included in web pages, allowing an authenticated attacker to inject malicious scripts into the system. These scripts are stored in the database and executed in the browsers of other users, including administrators, when they view the affected pages. Exploitation requires authentication and some user interaction, and a proof-of-concept exploit is publicly available. [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to session hijacking, unauthorized actions such as creating admin accounts or deleting passes, phishing attacks via injected fake login forms, keystroke logging, and website defacement. Since malicious scripts execute in the browsers of other users, attackers can steal session cookies and perform actions with the privileges of the compromised users, potentially compromising data integrity and security. [2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the /public/admin/roles/create page for persistent cross-site scripting (XSS) by submitting typical XSS payloads such as <img src=x onerror=alert('XSS')> in form fields like 'Title'. Monitoring for unexpected JavaScript execution or alerts when viewing roles pages can indicate exploitation. Since the vulnerability requires authentication, testing should be done with valid credentials. There are no specific network commands provided, but manual or automated web application security testing tools can be used to inject and detect XSS payloads in the roles creation form. [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves applying proper output encoding on user-supplied data before rendering it in HTML. Specifically, use PHP's htmlspecialchars() function with ENT_QUOTES and UTF-8 flags to encode inputs such as the 'Title' field in the roles creation page. For example, replace vulnerable code like echo $row['full_name']; with echo htmlspecialchars($row['full_name'], ENT_QUOTES, 'UTF-8');. Since no official patch is available, consider replacing the affected component or restricting access to the vulnerable page until a fix is implemented. [2]

Useful 0 Not Useful 0