CVE-2025-10612: City Guide Reflected XSS Vulnerability

CVE-2025-10612 Overview

CVE-2025-10612 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in giSoft Information Technologies City Guide. The flaw stems from improper neutralization of user-supplied input during web page generation. Attackers can craft malicious URLs that, when clicked by a victim, execute arbitrary JavaScript in the victim's browser under the context of the vulnerable City Guide application.

The issue affects all City Guide versions before 1.4.45. Exploitation requires user interaction, typically through social engineering such as phishing links. Successful attacks can lead to session hijacking, credential theft, and unauthorized actions performed on behalf of the victim.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling credential theft, session hijacking, and defacement across the City Guide application scope.

Affected Products

giSoft Information Technologies City Guide (all versions before 1.4.45)

Discovery Timeline

2025-10-21 - CVE-2025-10612 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10612

Vulnerability Analysis

CVE-2025-10612 is a reflected XSS vulnerability caused by the application returning attacker-controlled input in HTTP responses without proper output encoding or sanitization. When a user submits a request containing crafted payload data, the City Guide application reflects the input directly into the generated HTML response.

The attack scope is classified as changed, meaning the injected script can affect resources beyond the vulnerable component. Because the application executes in a web browser context, injected JavaScript inherits the origin's privileges. This includes access to cookies, session tokens, and the Document Object Model (DOM).

The vulnerability produces limited confidentiality and integrity impact. Availability is not directly affected. However, chained attacks against authenticated administrators can escalate the impact significantly.

Root Cause

The root cause is missing or insufficient input neutralization on one or more request parameters processed by City Guide before version 1.4.45. The application fails to apply context-appropriate output encoding (HTML entity encoding, JavaScript escaping, or attribute encoding) when rendering user-controlled values into response pages.

This maps to CWE-79: Improper Neutralization of Input During Web Page Generation. The absence of a Content Security Policy (CSP) further increases exploitability by allowing inline script execution.

Attack Vector

Exploitation is network-based and requires no authentication. An attacker crafts a URL containing a malicious script payload and delivers it via phishing email, social media, or a malicious website. When the victim clicks the link, the City Guide server reflects the payload into the response, and the browser executes it.

Typical payloads target session cookies, embed keyloggers, or perform Cross-Site Request Forgery (CSRF) actions against the authenticated session. See the USOM Notification TR-25-0350 for coordinated advisory details.

Detection Methods for CVE-2025-10612

Indicators of Compromise

HTTP request logs containing URL-encoded <script>, javascript:, onerror=, or onload= payloads targeting City Guide endpoints.
Anomalous outbound requests from user browsers to attacker-controlled domains immediately after visiting City Guide URLs.
Session cookies observed in unexpected geolocations or user agents following referrer traffic from City Guide.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag common XSS signatures in query strings, form parameters, and HTTP headers directed at City Guide.
Correlate reflected request payloads against server response bodies to identify parameters that echo untrusted input without encoding.
Monitor browser Content Security Policy (CSP) violation reports if CSP is deployed in report-only mode.

Monitoring Recommendations

Log all HTTP request parameters to City Guide endpoints and retain them for retrospective hunting.
Alert on high-volume click-through from external referrers containing suspicious query string patterns.
Track authentication anomalies such as session reuse from disparate IPs following user interaction with external links.

How to Mitigate CVE-2025-10612

Immediate Actions Required

Upgrade City Guide to version 1.4.45 or later without delay.
Invalidate active user sessions after patching to force re-authentication and clear potentially stolen tokens.
Notify users of the vulnerability and instruct them to avoid clicking untrusted City Guide links until patching completes.

Patch Information

The vendor addressed the vulnerability in City Guide version 1.4.45. Administrators should consult the Siber Güvenlik Notification TR-25-0350 and USOM Notification TR-25-0350 for official remediation guidance.

Workarounds

Deploy a WAF with XSS signature rulesets in blocking mode in front of City Guide until patching is complete.
Implement a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of script-based cookie theft.
Enable the SameSite=Strict cookie attribute to limit cross-site request abuse chained with XSS.

bash

# Configuration example: sample CSP and cookie hardening headers
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Set-Cookie: SESSIONID=<value>; HttpOnly; Secure; SameSite=Strict