CVE-2025-41001
BaseFortify
Publication date: 2025-11-10
Last updated on: 2025-11-21
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| soplanning | soplanning | 1.53.02 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-41001 is a stored Cross-Site Scripting (XSS) vulnerability in SOPlanning version 1.53.02. It occurs because the application does not properly validate user input sent via the 'LOGOUT_REDIRECT' parameter in a POST request to '/soplanning/www/process/options.php'. This flaw allows a remote attacker to craft a malicious query that, when an authenticated user accesses it, executes arbitrary scripts in the user's browser. This can lead to theft of the user's session cookies. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to execute malicious scripts in the context of an authenticated user's browser. This can lead to theft of session cookies, which may enable the attacker to hijack the user's session and gain unauthorized access to the application with the user's privileges. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the 'LOGOUT_REDIRECT' parameter in POST requests to the '/soplanning/www/process/options.php' endpoint for improper input validation and the ability to execute injected scripts. A practical approach is to send a crafted POST request with a script payload in the 'LOGOUT_REDIRECT' parameter and observe if the script executes in the context of an authenticated user's browser. Specific commands are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable endpoint to trusted users, avoiding clicking on suspicious links that exploit the 'LOGOUT_REDIRECT' parameter, and monitoring for unusual activity. Since the manufacturer is working on a patch, applying the patch as soon as it becomes available is recommended. Additionally, educating users about the risk of executing untrusted links can help reduce exploitation. [1]