Reflected XSS in Creativeitem Academy LMS Blog and Course Bundles

Impact Analysis

Reflected Cross-Site Scripting (XSS) vulnerabilities like CVE-2025-71179 can allow attackers to execute malicious scripts in the browsers of users who visit specially crafted URLs. This can lead to theft of session tokens, login credentials, or manipulation of site content.

Attackers can send malicious links to victims via email or messaging, and when victims click these links, the injected scripts run in their browsers, potentially compromising user accounts and data confidentiality and integrity.

Useful 0 Not Useful 0

Executive Summary

CVE-2025-71179 is a reflected Cross-Site Scripting (XSS) vulnerability in Creativeitem Academy LMS version 7.0. It occurs via the search parameter to the /academy/blogs endpoint and the string parameter to the /academy/course_bundles/search/query endpoint. This means that an attacker can inject malicious scripts into these parameters, which are then reflected back in the web application response, potentially executing in the victim's browser.

This vulnerability is distinct from a previous XSS issue (CVE-2023-4119) that affected different parameters and endpoints in an earlier version of the software.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a reflected Cross-Site Scripting (XSS) issue in Creativeitem Academy LMS 7.0, specifically via the search parameter to the /academy/blogs endpoint and the string parameter to the /academy/course_bundles/search/query endpoint.

To detect this vulnerability, you can test these endpoints by sending crafted HTTP GET requests with XSS payloads in the specified parameters and observe if the payload is reflected unescaped in the response.

• Use curl or similar tools to send requests with XSS payloads, for example:
• curl -G 'http://<target>/academy/blogs' --data-urlencode 'search=<script>alert(1)</script>'
• curl -G 'http://<target>/academy/course_bundles/search/query' --data-urlencode 'string="><img src=x onerror=alert(1)>'

If the response contains the injected script without proper encoding or sanitization, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps for reflected XSS vulnerabilities generally include sanitizing and encoding user input on the server side before reflecting it in responses.

Since this CVE description does not mention available patches or vendor fixes, you should:

• Implement input validation and output encoding on the affected parameters (search and string) to prevent script injection.
• Use a Web Application Firewall (WAF) to block malicious payloads targeting these endpoints.
• Educate users to avoid clicking suspicious links that may exploit this vulnerability.

Monitor for updates or patches from the vendor and apply them as soon as they become available.

Useful 0 Not Useful 0