CVE-2025-70890
BaseFortify
Publication date: 2026-01-15
Last updated on: 2026-01-15
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| phpgurukul | cyber_cafe_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stored cross-site scripting (XSS) issue in the Cyber Cafe Management System v1.0. An authenticated attacker can inject malicious JavaScript code into the username parameter through the add-users.php endpoint. This injected code is stored on the server and later executed in the browser of any user who accesses the affected page, potentially compromising their session or data. [2]
How can this vulnerability impact me? :
The vulnerability can allow attackers to execute arbitrary JavaScript in the context of other users' browsers. This can lead to theft of session cookies, defacement of the web interface, redirection to malicious sites, or other malicious actions that compromise user data and system integrity. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
To detect this stored XSS vulnerability, you can test the add-users.php endpoint by injecting JavaScript payloads into the username parameter and observing if the payload is stored and executed when accessing the affected page. For example, use curl or a similar tool to send a POST request with a payload like <script>alert(1)</script> in the username field. Example command: curl -X POST -d "username=<script>alert(1)</script>&other_params=values" http://yourserver/ccms/add-users.php Then, access the user listing or relevant page in a browser to see if the alert executes. This manual testing approach helps confirm the vulnerability presence. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include sanitizing and validating all user inputs on the server side, especially the username parameter in add-users.php, to prevent injection of malicious scripts. Implement output encoding when displaying user-supplied data to avoid execution of injected scripts. Additionally, restrict user privileges to limit who can add users, and consider applying web application firewalls (WAF) rules to detect and block XSS payloads. Updating the application code to properly handle input and output is essential for a permanent fix. [1]