CVE-2025-10914: OBS Student Affairs System XSS Flaw

CVE-2025-10914 Overview

CVE-2025-10914 is a reflected Cross-Site Scripting (XSS) vulnerability affecting Proliz Software Ltd. Co. OBS (Student Affairs Information System) versions prior to V26.0401. The flaw stems from improper neutralization of user-controlled input during web page generation [CWE-79]. Attackers can craft malicious URLs that, when clicked by an authenticated user, execute arbitrary JavaScript in the victim's browser session. The vulnerability impacts confidentiality, integrity, and availability of the affected web application. It is reachable over the network and requires user interaction to trigger.

Critical Impact
Successful exploitation allows attackers to hijack student or administrator sessions, steal credentials, and perform unauthorized actions within the OBS portal on behalf of victims.

Affected Products

Proliz Software Ltd. Co. OBS (Student Affairs Information System)
All OBS versions before V26.0401
Web-facing OBS deployments in educational institutions

Discovery Timeline

2025-10-23 - CVE-2025-10914 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-10914

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the OBS web application. User-supplied input is echoed back into HTTP responses without proper output encoding or input sanitization. An attacker delivers a crafted link containing JavaScript payloads to a logged-in user. When the victim loads the URL, the server reflects the payload into the rendered HTML, and the browser executes it within the OBS origin.

Reflected XSS in a student information system is significant because OBS handles academic records, enrollment data, grades, and personal information. JavaScript executed in an authenticated session inherits the victim's privileges within the portal. Administrative accounts are especially attractive targets given their broader access.

Root Cause

The root cause is missing or insufficient output encoding when rendering request parameters into HTML responses. The application trusts client-supplied values and inserts them directly into the DOM or server-rendered markup. No Content Security Policy (CSP) is enforced to break script execution as a defense-in-depth measure.

Attack Vector

Exploitation requires the attacker to deliver a malicious URL to a target who has an active OBS session or who authenticates after clicking. Delivery commonly occurs through phishing emails, instant messages, or links posted on forums frequented by students and staff. The payload runs with the victim's session cookies and can read or modify data the user is authorized to access.

No verified public proof-of-concept code is available. See the USOM Security Notification TR-25-0357 for the official advisory.

Detection Methods for CVE-2025-10914

Indicators of Compromise

HTTP requests to OBS endpoints containing reflected query parameters with <script>, onerror=, onload=, or javascript: substrings
Unusual outbound requests from user browsers to attacker-controlled domains immediately after visiting OBS URLs
OBS access logs showing URL parameters with encoded payloads such as %3Cscript%3E or %3Cimg%20src
Session token reuse from unexpected IP addresses or geolocations after a phishing campaign

Detection Strategies

Inspect web server and reverse proxy logs for request parameters containing HTML tags, event handlers, or JavaScript URI schemes
Deploy a web application firewall (WAF) rule set targeting reflected XSS payload signatures against OBS hostnames
Monitor browser endpoint telemetry for child processes or network beacons originating from OBS browser tabs
Correlate phishing email gateway alerts referencing OBS-branded URLs with subsequent authentication anomalies

Monitoring Recommendations

Enable verbose HTTP request logging on the OBS application server, including full query strings and referrers
Forward web logs and authentication events to a centralized SIEM for correlation across users and sessions
Alert on spikes in 4xx and 5xx responses from OBS endpoints that may indicate payload probing
Review administrator account activity daily for actions performed shortly after clicking external links

How to Mitigate CVE-2025-10914

Immediate Actions Required

Upgrade Proliz OBS to version V26.0401 or later as the primary remediation
Force a session reset and require re-authentication for all OBS users following the upgrade
Notify students, faculty, and administrators about phishing risks targeting OBS URLs
Audit administrator and privileged account activity for the period preceding patch deployment

Patch Information

Proliz Software addresses the vulnerability in OBS V26.0401. Operators must upgrade to this version or later. Refer to the USOM Security Notification TR-25-0357 for vendor coordination details and confirm the upgrade with Proliz support channels.

Workarounds

Deploy a WAF in front of OBS with reflected XSS signatures enabled until the patch is applied
Enforce a strict Content Security Policy at the reverse proxy that blocks inline scripts and untrusted script sources
Set the HttpOnly and Secure flags on session cookies to limit JavaScript access to authentication tokens
Restrict OBS portal access to institutional networks or VPN where operationally feasible

bash

# Example nginx hardening for OBS until patched
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
proxy_cookie_path / "/; HttpOnly; Secure; SameSite=Strict";