CVE-2025-10075: Razormist Online Polling System XSS Flaw

CVE-2025-10075 Overview

CVE-2025-10075 is a cross-site scripting (XSS) vulnerability [CWE-79] in SourceCodester Online Polling System 1.0, developed by Razormist. The flaw resides in the /manage-profile.php script, where the firstname parameter is reflected without sufficient output encoding. Attackers can inject JavaScript that executes in the browsers of users who view the manipulated profile data. The vulnerability is remotely exploitable and requires authenticated low-privileged access plus user interaction. Public disclosure through VulDB and GitHub has made exploitation details available to the public.

Critical Impact
Authenticated attackers can inject arbitrary script into the firstname field via /manage-profile.php, enabling session abuse, UI defacement, and credential theft against other application users.

Affected Products

Razormist Online Polling System 1.0
SourceCodester-distributed Online Polling System builds using manage-profile.php
Deployments identified by CPE cpe:2.3:a:razormist:online_polling_system:1.0

Discovery Timeline

2025-09-08 - CVE-2025-10075 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10075

Vulnerability Analysis

The vulnerability is a reflected or stored cross-site scripting flaw in the profile management workflow of Online Polling System 1.0. The firstname parameter supplied to /manage-profile.php is written back to the rendered page without HTML entity encoding. An authenticated user can submit a payload containing <script> or event-handler attributes that executes in another viewer's browser session. Because the polling application manages user accounts, poll authorship, and administrative controls, injected script can be used to hijack sessions, exfiltrate cookies, or trigger unauthorized actions against the application through the victim's authenticated context.

Root Cause

The root cause is missing input sanitization and output encoding on the firstname field in manage-profile.php. The application trusts user-supplied profile data when rendering HTML, violating the standard practice of contextual output encoding described in CWE-79.

Attack Vector

Exploitation requires network access to the application and a low-privileged account that can edit a profile. The attacker submits a crafted firstname value containing JavaScript. Any user — including administrators — who subsequently views the attacker-controlled profile data triggers execution of the payload. Public exploit details are referenced in the GitHub issue tracker and in VulDB entry #323023.

// No verified exploit code is published inline.
// See the referenced GitHub issue and VulDB record for
// the full proof-of-concept payload structure.

Detection Methods for CVE-2025-10075

Indicators of Compromise

HTTP POST requests to /manage-profile.php containing <script>, onerror=, onload=, or javascript: substrings in the firstname parameter.
Profile records in the application database where the firstname column contains HTML or JavaScript syntax.
Outbound requests from user browsers to attacker-controlled domains shortly after loading pages that render profile data.

Detection Strategies

Inspect web server access logs for anomalous firstname values submitted to manage-profile.php, flagging encoded angle brackets (%3C, %3E) and common XSS keywords.
Deploy a web application firewall (WAF) rule set that blocks reflected XSS signatures on the profile endpoints.
Perform periodic database integrity scans on user profile tables to detect persisted script payloads.

Monitoring Recommendations

Enable Content Security Policy (CSP) violation reporting to capture inline script execution attempts on profile pages.
Alert on repeated profile edits from a single account in short time windows, which may indicate payload tuning.
Monitor session cookie usage for impossible-travel or concurrent-session anomalies that could follow a successful XSS-based session theft.

How to Mitigate CVE-2025-10075

Immediate Actions Required

Restrict access to /manage-profile.php to trusted users while a fix is applied, or take the application offline if it is internet-exposed.
Sanitize existing database records by stripping HTML from historical firstname values.
Rotate session identifiers and force reauthentication for all users to invalidate any session tokens potentially captured through exploitation.

Patch Information

No vendor-supplied patch is listed in the NVD advisory for Razormist Online Polling System 1.0. Operators should track updates through the SourceCodester project page and the VulDB submission record for remediation status.

Workarounds

Apply server-side input validation that rejects angle brackets and HTML entities in the firstname parameter.
Enforce contextual output encoding (for example, htmlspecialchars($value, ENT_QUOTES, 'UTF-8')) wherever profile fields are rendered.
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to a trusted allowlist.
Place the application behind a WAF with cross-site scripting signatures enabled until an official patch is released.

bash

# Example PHP sanitization pattern applied before persistence
# $firstname = htmlspecialchars(trim($_POST['firstname']), ENT_QUOTES, 'UTF-8');
# if (preg_match('/[<>"\\\']/', $firstname)) { http_response_code(400); exit; }