Advaya Softech GEMS ERP Portal Foutmelding home.jsp cross site scripting

Successful exploitation of CVE-2025-15170 allows an attacker to inject arbitrary JavaScript code into the GEMS ERP Portal. This can lead to various malicious outcomes, including session hijacking, defacement of the web application, and theft of sensitive user data such as login credentials or financial information. The remote nature of the vulnerability means an attacker doesn't require local access to the system. Given the ERP nature of the application, the potential blast radius extends to all data managed within the system, including customer records, financial transactions, and inventory data. The public disclosure of this vulnerability significantly increases the risk of exploitation.

Organizations utilizing GEMS ERP Portal versions 2.0 and 2.1, particularly those with sensitive data or critical business processes managed within the system, are at significant risk. Shared hosting environments where multiple tenants share the same server instance are also particularly vulnerable, as a compromise of one tenant could potentially impact others.

• java / web server: Monitor access logs for requests to /home.jsp?isError=true with unusual or suspicious parameters in the Message field. Look for patterns indicative of script injection (e.g., <script>, javascript:, eval()).

grep 'GET /home.jsp\?isError=true.*Message=' /var/log/apache2/access.log

• generic web: Use curl to test the endpoint with various payloads to see if they are reflected in the response.

curl 'http://<target>/home.jsp?isError=true&Message=<script>alert(1)</script>' | grep '<script>'

• generic web: Check response headers for unusual content-security-policy directives that might be bypassed.

curl -I http://<target>/home.jsp?isError=true | grep Content-Security-Policy

1. 2025-12-29Disclosure

   disclosure

2. 2025-12-29Patch

   patch

1. Gereserveerd2025-12-27
2. Gepubliceerd2025-12-29
3. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-15170 is to upgrade GEMS ERP Portal to version 2.1.1 or later, which includes the necessary fix. If immediate upgrading is not possible, consider implementing a Web Application Firewall (WAF) rule to filter requests to the /home.jsp?isError=true endpoint, specifically blocking requests with manipulated 'Message' parameters. Input validation on the server-side, specifically sanitizing user-supplied input before rendering it in the response, can also help prevent XSS attacks. Regularly review and update the application's security configuration to minimize the attack surface.