CVE-2025-61549
BaseFortify
Publication date: 2026-01-08
Last updated on: 2026-02-10
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| edubusinesssolutions | print_shop_pro_webdesk | 18.34 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Scripting (XSS) issue found in the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint of edu Business Solutions Print Shop Pro WebDesk version 18.34. It occurs because user input is not properly sanitized or encoded before being reflected in HTTP responses, allowing attackers to inject and execute arbitrary JavaScript code in the victim's browser session.
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute malicious JavaScript in the context of a user's browser session. This can lead to theft of sensitive information such as cookies or session tokens, unauthorized actions performed on behalf of the user, or redirection to malicious sites, potentially compromising user accounts and data.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by testing the /PSP/app/web/reg/reg_display.asp endpoint for Cross-Site Scripting (XSS) on the LoginID parameter. This involves sending HTTP requests with payloads containing JavaScript code in the LoginID parameter and observing if the response reflects the input without proper encoding or escaping. For example, you can use curl or similar tools to send requests like: curl -G 'http://target/PSP/app/web/reg/reg_display.asp' --data-urlencode 'LoginID=<script>alert(1)</script>' and check if the script is executed or reflected in the response. Automated scanners that test for reflected XSS can also be used. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying input validation and output encoding on the LoginID parameter to ensure that any user-supplied data is properly sanitized before being reflected in HTTP responses. If a patch or update is available from edu Business Solutions for Print Shop Pro WebDesk version 18.34, apply it promptly. Additionally, consider implementing Web Application Firewall (WAF) rules to block malicious payloads targeting this endpoint until a permanent fix is applied. [1]