CVE-2025-2371: Phpgurukul HMPTMS XSS Vulnerability

CVE-2025-2371 Overview

CVE-2025-2371 is a reflected cross-site scripting (XSS) vulnerability in PHPGurukul Human Metapneumovirus Testing Management System 1.0. The flaw resides in the /registered-user-testing.php script, within the Registered Mobile Number Search component. Attackers can manipulate the regmobilenumber parameter to inject arbitrary JavaScript that executes in the context of a victim's browser session. The issue is categorized under CWE-79. Exploitation requires network access and some user interaction, and the proof-of-concept has been publicly disclosed.

Critical Impact
Remote attackers can execute arbitrary JavaScript in a victim's browser to steal session cookies, perform actions on behalf of authenticated users, or deliver follow-on payloads.

Affected Products

PHPGurukul Human Metapneumovirus Testing Management System 1.0
Vulnerable component: /registered-user-testing.php
Vulnerable parameter: regmobilenumber (Registered Mobile Number Search)

Discovery Timeline

2025-03-17 - CVE-2025-2371 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2371

Vulnerability Analysis

The vulnerability is a reflected XSS in the Registered Mobile Number Search workflow of the HMPV Testing Management System. The script /registered-user-testing.php accepts the regmobilenumber request parameter and renders its value back into the HTTP response without proper output encoding or input sanitization. An attacker crafts a URL containing a malicious payload in regmobilenumber and lures an authenticated user to visit it. The injected script then runs with the privileges of the user's active session.

Because the application serves medical testing data, successful exploitation can expose patient-related records, hijack administrative sessions, or pivot to additional application endpoints via forged requests. See the GitHub PoC for HMPV XSS and the VulDB #299870 Analysis for additional context. EPSS currently rates exploitation probability at 0.371% (28.8 percentile).

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The application concatenates the user-supplied regmobilenumber value directly into HTML output without applying context-aware encoding such as HTML entity escaping. No server-side validation enforces that the parameter contains only numeric characters, which would be the expected format for a mobile number.

Attack Vector

Exploitation occurs over the network and requires low privileges plus user interaction. An attacker constructs a URL that targets /registered-user-testing.php with a JavaScript payload embedded in the regmobilenumber query parameter. The attacker delivers the link through phishing, chat, or a malicious third-party site. When an authenticated user opens the link, the server reflects the payload into the response and the browser executes it in the application's origin.

The vulnerability mechanism involves direct reflection of the regmobilenumber parameter into HTML. Refer to the VulDB #299870 Details for the published proof-of-concept request format.

Detection Methods for CVE-2025-2371

Indicators of Compromise

HTTP GET or POST requests to /registered-user-testing.php containing <script>, onerror=, onload=, or URL-encoded equivalents in the regmobilenumber parameter.
Web server access logs showing unusually long regmobilenumber values or non-numeric characters.
Browser console errors or outbound requests to attacker-controlled domains originating from the HMPV application domain.

Detection Strategies

Deploy a web application firewall rule that inspects the regmobilenumber parameter and blocks requests containing HTML tags or JavaScript event handlers.
Enable Content Security Policy (CSP) violation reporting to surface injected inline scripts rendered by the application.
Correlate referrer headers with external domains to identify users arriving via crafted phishing URLs.

Monitoring Recommendations

Alert on repeated 200 responses to /registered-user-testing.php with query strings exceeding typical length baselines.
Monitor authenticated session anomalies such as unexpected cookie exfiltration patterns or session reuse from new IP addresses.
Review proxy or SIEM logs for sequences where a search request is immediately followed by sensitive endpoint access from the same session.

How to Mitigate CVE-2025-2371

Immediate Actions Required

Restrict access to /registered-user-testing.php using network controls or authentication gates until a vendor fix is applied.
Deploy WAF signatures that reject non-numeric input in the regmobilenumber parameter.
Instruct users and administrators to avoid clicking unsolicited links referencing the HMPV application.

Patch Information

At the time of this writing, no vendor patch is listed in the NVD entry or on the PHP Gurukul Resource site. Organizations running version 1.0 should monitor the vendor for an updated release and apply it immediately upon availability. Consult the VulDB #515347 Submission for ongoing tracking.

Workarounds

Implement a reverse proxy filter that validates regmobilenumber against a strict numeric regular expression such as ^[0-9]{6,15}$.
Add a Content Security Policy header that disallows inline scripts and restricts script sources to trusted origins.
Apply HTTP-only and Secure flags to session cookies to limit JavaScript access in the event of successful injection.
Modify the application source to HTML-encode the regmobilenumber value before rendering it in any response template.

bash

# Example nginx reverse proxy rule to drop non-numeric regmobilenumber values
location = /registered-user-testing.php {
    if ($arg_regmobilenumber !~ "^[0-9]{0,15}$") {
        return 400;
    }
    proxy_pass http://backend;
}

# Example Content Security Policy header
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'";