CVE-2025-15479: NGSurvey Stored XSS Vulnerability

CVE-2025-15479 Overview

A stored cross-site scripting (XSS) vulnerability exists in the survey content and administration functionality of Data Illusion Zumbrunn NGSurvey Enterprise Edition version 3.6.4. This CWE-79 vulnerability affects both Windows and Linux server deployments, allowing authenticated remote users with survey creation or edit privileges to execute arbitrary JavaScript in other users' browsers, steal session information, and perform unauthorized actions on their behalf via crafted survey content that is rendered without proper output encoding.

Critical Impact

Attackers with survey creation privileges can inject malicious JavaScript that executes in the browsers of other users, including administrators, enabling session hijacking and unauthorized actions across the survey platform.

Affected Products

• Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4
• Windows Server deployments of NGSurvey
• Linux Server deployments of NGSurvey

Discovery Timeline

• 2026-01-07 - CVE CVE-2025-15479 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-15479

Vulnerability Analysis

This stored XSS vulnerability resides in the survey content and administration functionality of NGSurvey Enterprise Edition. The application fails to properly sanitize and encode user-supplied input when survey content is created or edited by authenticated users. When this crafted content is subsequently rendered for other users viewing the survey—including administrators—the malicious JavaScript executes within their browser context.

Stored XSS vulnerabilities are particularly dangerous because the malicious payload persists in the application database and can affect multiple users over time without requiring additional attacker interaction. In this case, any user with survey creation or editing privileges can weaponize this functionality to target other platform users.

Root Cause

The root cause of this vulnerability is improper output encoding in the survey rendering functionality. When survey content is stored in the database and later retrieved for display, the application does not apply appropriate HTML entity encoding or contextual output escaping. This allows script tags and JavaScript event handlers embedded in survey content to be interpreted and executed by the browser rather than being displayed as harmless text.

Attack Vector

The attack vector is network-based and requires authentication with survey creation or edit privileges. An attacker would craft malicious survey content containing JavaScript payloads, which could include script tags, event handlers (such as onerror, onload), or other XSS vectors. When another user—particularly an administrator—views the compromised survey content, the malicious JavaScript executes in their browser session.

This enables several attack scenarios:

• Session cookie theft via document.cookie access
• Credential harvesting through fake login overlays
• Performing administrative actions on behalf of compromised users
• Redirecting users to phishing sites
• Defacing survey content visible to end users

The vulnerability can be exploited by injecting malicious JavaScript into survey fields that accept rich content. The payload executes when the survey content is rendered in another user's browser context, enabling session hijacking and unauthorized actions. See the Thales Group CVE Advisory for additional technical details.

Detection Methods for CVE-2025-15479

Indicators of Compromise

• Unusual JavaScript patterns in survey content fields such as <script> tags or event handlers
• Survey content containing encoded JavaScript payloads (HTML entities, URL encoding, Unicode)
• Unexpected outbound connections from user browsers to external domains after viewing surveys
• Session anomalies where users report being logged out or actions they did not perform

Detection Strategies

• Implement web application firewall (WAF) rules to detect common XSS patterns in survey submission requests
• Enable content security policy (CSP) headers to restrict inline script execution and report violations
• Monitor application logs for survey content containing suspicious patterns like <script, javascript:, or event handlers
• Deploy endpoint detection solutions to identify browser-based attacks originating from the survey platform

Monitoring Recommendations

• Enable verbose logging for survey creation and modification activities
• Monitor for CSP violation reports that may indicate attempted XSS exploitation
• Review survey content periodically for suspicious JavaScript patterns
• Implement real-time alerting on survey content modifications by users with elevated privileges

How to Mitigate CVE-2025-15479

Immediate Actions Required

• Upgrade NGSurvey Enterprise Edition to version 3.6.17 or later which addresses this vulnerability
• Audit existing survey content for malicious JavaScript payloads
• Review user accounts with survey creation privileges and remove unnecessary access
• Implement Content Security Policy (CSP) headers to mitigate XSS impact
• Enable HTTPOnly and Secure flags on session cookies to reduce session theft risk

Patch Information

Data Illusion has released version 3.6.17 of NGSurvey Enterprise Edition which addresses this stored XSS vulnerability. Organizations should upgrade to this version or later as soon as possible. The patch implements proper output encoding for survey content to prevent JavaScript execution. For detailed patch information, refer to the ngSurvey Change Log Update.

Workarounds

• Restrict survey creation and editing privileges to trusted administrative users only
• Implement a Web Application Firewall (WAF) with XSS filtering rules
• Deploy strict Content Security Policy headers to block inline script execution
• Manually review and sanitize survey content before publication if patching is delayed

# Example Content Security Policy header configuration for Apache
# Add to .htaccess or httpd.conf to mitigate XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline';"

# For Nginx, add to server block
# add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always;