CVE-2025-10467: PROLIZ OBS Stored XSS Vulnerability

CVE-2025-10467 Overview

CVE-2025-10467 is a stored Cross-Site Scripting (XSS) vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS (Student Affairs Information System). The flaw affects all versions of OBS before v25.0401 and is classified under CWE-79. Authenticated attackers with low privileges can inject persistent malicious scripts that execute in other users' browsers when the affected pages are rendered. The scope change in the CVSS vector indicates that exploitation impacts components beyond the vulnerable application, including session contexts of higher-privileged users.

Critical Impact
Stored XSS in OBS enables attackers to hijack administrative sessions, exfiltrate student records, and pivot to broader compromise of the Student Affairs Information System.

Affected Products

PROLIZ OBS (Student Affairs Information System) versions before v25.0401
Web-facing student portal components of OBS
Administrative interfaces consuming user-supplied input within OBS

Discovery Timeline

2025-09-25 - CVE-2025-10467 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10467

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input during web page generation in the OBS application. Input submitted through authenticated user fields is stored in the application backend and later rendered in HTML output without adequate encoding or sanitization. When other users access the affected pages, the injected payload executes in their browser within the OBS origin.

Because OBS is a Student Affairs Information System, the application processes sensitive academic, identity, and administrative data. A successful stored XSS attack can lead to session token theft, unauthorized record modification, and forced actions on behalf of victim users. The scope-changed impact indicates that the executed script can affect security boundaries beyond the immediate vulnerable component, such as administrative consoles loaded in the same browser context.

Root Cause

The root cause is the failure to sanitize or contextually encode untrusted input before persisting it and rendering it in HTML responses. OBS does not apply output encoding for user-controlled fields, allowing arbitrary HTML and JavaScript to be stored and replayed to subsequent viewers.

Attack Vector

Exploitation requires network access to the OBS application and low-privileged authenticated access. An attacker submits a malicious payload through a vulnerable input field that accepts free-form text. The payload is persisted by the application and later rendered when a privileged user, such as a staff member or administrator, views the affected page. User interaction is required for the script to execute, but the persistent storage makes the attack reliable and repeatable.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-10467

Indicators of Compromise

Unexpected <script>, <iframe>, or event handler attributes (onerror, onload) stored within OBS database fields tied to student or staff records
Outbound HTTP requests from staff browsers to attacker-controlled domains immediately after viewing OBS pages
Anomalous session token reuse from geographically distinct IP addresses following access to OBS administrative views

Detection Strategies

Review OBS web server access logs for POST requests containing HTML or JavaScript metacharacters such as <, >, ", and javascript: in form parameters
Deploy a Content Security Policy (CSP) in report-only mode to identify inline script execution sourced from injected content
Perform database audits across OBS tables that store user-provided text to identify embedded script payloads

Monitoring Recommendations

Monitor for unusual administrative actions performed shortly after staff users open student-submitted records
Alert on browser console errors or CSP violation reports originating from OBS application origins
Track creation of new privileged accounts or password changes within OBS that follow staff session activity

How to Mitigate CVE-2025-10467

Immediate Actions Required

Upgrade OBS to version v25.0401 or later as released by PROLIZ
Inventory all OBS instances exposed to networks and restrict access to trusted segments until patched
Force re-authentication of all OBS users and rotate session secrets after upgrading
Audit stored records for previously injected payloads and sanitize affected entries

Patch Information

PROLIZ addresses CVE-2025-10467 in OBS v25.0401. Administrators should consult the Turkish national CERT advisories at USOM Notification TR-25-0298 and Siber Güvenlik Notification TR-25-0298 for vendor coordination details and apply the fixed release distributed by PROLIZ.

Workarounds

Restrict OBS access to authenticated internal users only via VPN or IP allowlists until the patch is applied
Deploy a web application firewall (WAF) rule set that blocks common XSS payload patterns targeting OBS endpoints
Enforce a strict Content Security Policy that disallows inline scripts and unauthorized script sources on OBS responses

bash

# Example NGINX configuration enforcing CSP and XSS protections in front of OBS
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;