code-projects Real Estate Property Management System CustomerReport.php cross site scripting

Successful exploitation of CVE-2025-1171 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to various malicious actions, including session hijacking, credential theft, and defacement of the application's user interface. The vulnerability resides within the /Admin/CustomerReport.php file, specifically when the 'Address' argument is manipulated. An attacker could craft a malicious URL containing a specially crafted 'Address' parameter, which, when accessed by a legitimate user, would execute the attacker's script. This could be used to steal sensitive information or redirect users to phishing sites.

Organizations utilizing the Real Estate Property Management System, particularly those with administrative interfaces accessible over the internet, are at risk. Shared hosting environments where multiple users share the same server instance are also particularly vulnerable, as a compromised user account could potentially impact other users on the same server.

• php: Examine the /Admin/CustomerReport.php file for improper input validation or output encoding of the 'Address' parameter. Search for instances where user-supplied data is directly inserted into HTML without sanitization. • generic web: Monitor access logs for requests to /Admin/CustomerReport.php containing unusual or suspicious characters in the 'Address' parameter (e.g., <script>, <img src=x onerror=alert(1)>). • generic web: Use curl to test the endpoint with various payloads: curl 'http://example.com/Admin/CustomerReport.php?Address=<script>alert(1)</script>' and observe the response for signs of script execution.

1. 2025-02-11Disclosure

   disclosure

1. Réservé2025-02-10
2. Publiée2025-02-11
3. Modifiée2025-02-18
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2025-1171 is to upgrade the Real Estate Property Management System to version 1.0.1 or later, which contains the necessary fix. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the 'Address' parameter within the /Admin/CustomerReport.php file. This can help prevent the injection of malicious scripts. Additionally, a Web Application Firewall (WAF) could be configured to filter requests containing suspicious characters or patterns in the 'Address' parameter. After upgrading, confirm the fix by attempting to access the /Admin/CustomerReport.php file with a known malicious 'Address' parameter; the script should not execute.