CVE-2025-13180: Bdtask Wholesale Inventory XSS Vulnerability

CVE-2025-13180 Overview

CVE-2025-13180 is a cross-site scripting (XSS) vulnerability in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System through version 20250320. The flaw resides in the /edit_profile endpoint, where the first_name and last_name parameters lack proper sanitization. An authenticated remote attacker can inject arbitrary script content that executes in the victim's browser context. The exploit details have been published, and the vendor did not respond to disclosure attempts. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-74 (Improper Neutralization of Special Elements).

Critical Impact
Attackers with low-privilege accounts can inject JavaScript through profile editing fields, enabling session hijacking, credential theft, or unauthorized actions against other users of the platform.

Affected Products

Bdtask Wholesale Inventory Control and Inventory Management System (all builds up to 20250320)
Distributions sold through CodeCanyon marketplace
Deployments exposing the /edit_profile endpoint to authenticated users

Discovery Timeline

2025-11-14 - CVE-2025-13180 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13180

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting flaw in the profile management workflow of Bdtask Wholesale Inventory Control. When a user submits data to /edit_profile, the application accepts the first_name and last_name values without applying HTML entity encoding or input validation. The unsanitized values are subsequently rendered back into the HTML response, allowing browser interpretation of injected markup and JavaScript.

Exploitation requires an authenticated session with basic user privileges and user interaction to trigger the payload. Successful injection lets an attacker execute JavaScript within the trust context of the application, exposing session cookies, CSRF tokens, and interactive UI actions. Additional technical detail is available in the GitHub PoC Vulnerability Issue and VulDB entry #332470.

Root Cause

The root cause is missing output encoding on user-controllable profile fields. The application echoes first_name and last_name directly into rendered HTML without contextual escaping. This violates standard secure coding guidance that requires HTML-encoding of all user-supplied data prior to rendering in a browser context.

Attack Vector

An attacker authenticates to the application with any valid account. The attacker submits an HTTP POST to /edit_profile containing a script payload in the first_name or last_name field. Any subsequent view of the affected profile page executes the injected script in the viewer's browser. The attack is remotely exploitable over the network and requires user interaction to trigger the injected content.

No verified exploitation code is published in a curated exploit database. Public proof-of-concept notes are referenced in the PoCVulDb repository issue.

Detection Methods for CVE-2025-13180

Indicators of Compromise

HTTP POST requests to /edit_profile containing angle brackets, <script> tags, javascript: URIs, or common XSS payload strings in first_name or last_name parameters.
Web server access logs showing profile updates followed by anomalous outbound requests from browsers rendering the affected pages.
Unexpected session token exfiltration or account activity following views of user profile pages.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set to inspect POST bodies to /edit_profile for XSS signatures and reject requests containing script markup.
Monitor application logs for HTML metacharacters (<, >, ", ', &) submitted through profile fields.
Implement Content Security Policy (CSP) violation reporting to surface script execution from untrusted sources.

Monitoring Recommendations

Alert on repeated failed profile update attempts and on updates containing encoded payloads such as %3Cscript%3E or <script>.
Correlate authenticated user sessions that update profile data with immediate session cookie usage from unfamiliar IP addresses.
Review browser-side error and CSP reports for injected inline scripts originating from the application domain.

How to Mitigate CVE-2025-13180

Immediate Actions Required

Restrict access to the Wholesale Inventory Control application to trusted networks or authenticated internal users while a fix is unavailable.
Deploy WAF rules that block script tags, event handler attributes, and javascript: schemes in the first_name and last_name parameters submitted to /edit_profile.
Audit existing user profile records for stored payloads and sanitize any records containing HTML or script content.

Patch Information

No vendor patch has been published. According to the NVD entry, the vendor was contacted early but did not respond to the disclosure. Track the VulDB advisory #332470 for updates, and contact Bdtask directly through CodeCanyon support channels for remediation guidance.

Workarounds

Apply server-side input validation that rejects HTML metacharacters in name fields, or implement strict allowlists limited to alphanumeric characters, spaces, hyphens, and apostrophes.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Configure HttpOnly and Secure flags on session cookies to reduce impact if script execution occurs.
Require re-authentication for sensitive actions to limit the scope of session-riding attacks.

bash

# Example ModSecurity rule to block script content in profile fields
SecRule REQUEST_URI "@streq /edit_profile" \
  "phase:2,chain,deny,status:403,id:1013180,\
   msg:'CVE-2025-13180 XSS attempt in edit_profile'"
  SecRule ARGS:first_name|ARGS:last_name \
    "@rx (?i)(<script|javascript:|onerror=|onload=|<img|<svg)" \
    "t:none,t:urlDecodeUni,t:htmlEntityDecode"