SourceCodester Image Compressor Tool compressor.php cross site scripting

Successful exploitation of CVE-2025-1169 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to various malicious actions, including stealing session cookies, redirecting users to phishing sites, or defacing the application. The impact is particularly severe if the application handles sensitive user data or is integrated with other systems. An attacker could leverage this to gain unauthorized access to user accounts or perform actions on their behalf. The vulnerability's remote accessibility significantly broadens the potential attack surface.

Organizations using SourceCodester Image Compressor Tool in production environments, particularly those with user authentication or sensitive data handling, are at risk. Shared hosting environments where multiple users share the same server instance are especially vulnerable, as an attacker could potentially compromise other users through this vulnerability.

• php / server:

grep -r "/image-compressor/compressor.php" /var/log/apache2/access.log

• generic web:

curl -I http://your-server.com/image-compressor/compressor.php?image=<script>alert(1)</script>

1. 2025-02-11Disclosure

   disclosure

1. Reservado2025-02-10
2. Publicada2025-02-11
3. Modificada2025-02-18
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2025-1169 is to upgrade to version 1.0.1 of SourceCodester Image Compressor Tool. If immediate upgrading is not possible, consider implementing input validation and sanitization on the 'image' parameter in /image-compressor/compressor.php to prevent the injection of malicious scripts. While a Web Application Firewall (WAF) might offer some protection, it's not a substitute for patching. Review and update any existing security policies to reflect this vulnerability and its potential impact.