CampCodes DepEd Equipment Inventory System add_employee.php 跨站脚本漏洞

Successful exploitation of CVE-2025-0348 allows an attacker to inject arbitrary JavaScript code into the DepEd Equipment Inventory System. This code can then be executed in the context of a user's browser when they access the affected page. The attacker could potentially steal session cookies, redirect users to malicious websites, or deface the application. The impact is primarily focused on user interaction and data theft, but could be amplified if the system handles sensitive information or is integrated with other critical systems. While the CVSS score is LOW, the public disclosure and ease of exploitation make it a significant concern.

Organizations and institutions utilizing the DepEd Equipment Inventory System version 1.0, particularly those with limited resources for immediate patching, are at risk. Shared hosting environments where multiple users share the same server and application code are also at increased risk, as a vulnerability in one application can potentially impact others.

• php / web:

 grep -r "<script" /var/www/html/data/add_employee.php

• generic web:

curl -I http://your-deped-inventory-system/data/add_employee.php | grep -i "X-XSS-Protection"

1. 2025-01-09Disclosure

   disclosure

1. 已保留2025-01-08
2. 发布日期2025-01-09
3. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2025-0348 is to upgrade to version 1.0.1 of the DepEd Equipment Inventory System. This version contains a fix for the XSS vulnerability. If upgrading immediately is not possible, consider implementing input validation and output encoding on the /data/add_employee.php page to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Regularly review and update security configurations to minimize the attack surface.