CVE-2025-13245: Low-Severity XSS Threat in Student Information System 2.0

Overview

CVE-2025-13245 describes a Cross-Site Scripting (XSS) vulnerability identified in the Code-Projects Student Information System version 2.0. This vulnerability allows an attacker to inject malicious scripts into the application, potentially compromising user data or system integrity. The vulnerable component resides within the /editprofile.php file.

Technical Details

The vulnerability exists due to insufficient input sanitization within the /editprofile.php file. An attacker can exploit this by crafting a malicious URL or form submission that injects JavaScript code. When a user interacts with the affected page, the injected script will execute in their browser, potentially allowing the attacker to steal cookies, redirect the user to a malicious website, or perform other actions on behalf of the user.

The specific function impacted is currently unknown but involves handling user-supplied data during profile editing.

CVSS Analysis

• CVSS Score: 3.5 (Low)
• CVSS Vector: (Base Score only, the full vector would depend on the specific input field and exploit details – it is reasonable to assume AV:N/AC:L/PR:N/UI:R/S:N/C:N/I:L/A:N)

Despite the low CVSS score, it’s important to address this vulnerability. XSS vulnerabilities can be chained with other vulnerabilities to create more severe attacks.

Possible Impact

While the severity is rated as low, successful exploitation of this XSS vulnerability could lead to:

• Account Takeover: Stealing user cookies and session data to impersonate legitimate users.
• Defacement: Modifying the appearance of the website to display malicious content.
• Redirection: Redirecting users to phishing websites or other malicious destinations.
• Information Disclosure: Accessing sensitive user information displayed on the page.

Mitigation or Patch Steps

To mitigate the risk of CVE-2025-13245, the following steps are recommended:

1. Input Sanitization: Implement proper input sanitization on all user-supplied data within the /editprofile.php file. Specifically, escape HTML entities and JavaScript-specific characters.
2. Output Encoding: Encode data before it is rendered in the browser. Use appropriate encoding functions to prevent the execution of injected scripts.
3. Web Application Firewall (WAF): Deploy a WAF to detect and block XSS attacks. Configure the WAF to filter potentially malicious requests.
4. Update Software: Check for updates or patches provided by Code-Projects and apply them immediately. If no official patch is available, consider implementing custom mitigation measures.
5. User Education: Educate users about the risks of clicking on suspicious links or entering personal information on untrusted websites.

References

• Code-Projects
• GitHub Exploit Example
• VulDB – CVE Information
• VulDB – Vulnerability Details
• VulDB – Source Information