CVE-2025-2645: PHPGurukul Art Gallery XSS Vulnerability

CVE-2025-2645 Overview

CVE-2025-2645 is a cross-site scripting (XSS) vulnerability in PHPGurukul Art Gallery Management System 1.0. The flaw resides in the /product.php endpoint, where the artname argument is reflected into HTTP responses without proper output encoding. Attackers can execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The exploit has been disclosed publicly and can be launched remotely over the network. The weakness is tracked under CWE-79.

Critical Impact
Remote attackers can inject JavaScript into product.php responses via the artname parameter, enabling session hijacking, credential theft, and browser-based actions against authenticated users.

Affected Products

PHPGurukul Art Gallery Management System 1.0
CPE: cpe:2.3:a:phpgurukul:art_gallery_management_system:1.0
Vulnerable component: /product.php (artname parameter)

Discovery Timeline

2025-03-23 - CVE-2025-2645 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2645

Vulnerability Analysis

The application accepts the artname query parameter on /product.php and echoes its value into the HTML response without sanitization or contextual encoding. Because the reflected content is rendered as HTML, an attacker who controls the parameter can inject script tags or event handlers that execute in the victim's browser session. The attack requires user interaction, typically clicking a crafted link, and low-privilege authentication in the application context.

Successful exploitation runs JavaScript under the origin of the vulnerable site. Attackers can steal session cookies, forge requests on behalf of the user, or pivot to further application abuse such as administrative actions if a privileged user is targeted. Additional technical context is available in the GitHub Issue Discussion and VulDB #300660.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. User-controlled input from the artname GET parameter is concatenated into the response without HTML entity encoding or an allowlist filter. No Content Security Policy (CSP) is enforced to constrain inline script execution.

Attack Vector

Exploitation occurs over the network via a crafted URL delivered through phishing, forum posts, or third-party sites. The victim must be lured into loading the malicious link while browsing the target application. Because the payload is reflected rather than stored, each attack instance is per-victim and per-request.

No verified proof-of-concept code has been published. The vulnerability follows the standard reflected XSS pattern: /product.php?artname=<script>...</script> produces attacker-controlled script execution in the rendered page. See the VulDB CTI entry for disclosure metadata.

Detection Methods for CVE-2025-2645

Indicators of Compromise

Web server access logs containing product.php requests with artname values that include <, >, script, onerror, onload, or URL-encoded equivalents (%3C, %3E).
Outbound requests from user browsers to attacker-controlled domains shortly after visiting /product.php links.
Session cookie reuse from unexpected IP addresses or geographies following a suspected phishing campaign referencing the gallery application.

Detection Strategies

Deploy a web application firewall (WAF) rule set to flag reflected XSS patterns in the artname query parameter.
Enable server-side logging of full query strings and hunt for HTML metacharacters or JavaScript keywords in product.php requests.
Correlate referrer headers pointing to external domains with successful HTTP 200 responses from /product.php to identify inbound phishing traffic.

Monitoring Recommendations

Alert on any HTTP request to /product.php where the artname value exceeds a reasonable length or contains encoded script fragments.
Monitor authentication logs for session activity from multiple IPs within short time windows, which can indicate cookie theft.
Capture Content Security Policy violation reports if CSP is deployed, focusing on script-src and inline-script violations originating from product.php.

How to Mitigate CVE-2025-2645

Immediate Actions Required

Restrict public access to /product.php until a patched build or hotfix is applied, or place the application behind a WAF with XSS filtering enabled.
Invalidate active sessions and rotate authentication cookies for users who may have clicked untrusted links referencing the application.
Apply strict output encoding to the artname parameter by wrapping its render location with htmlspecialchars($artname, ENT_QUOTES, 'UTF-8') in a local patch.

Patch Information

No official vendor patch has been published in the referenced advisories at time of writing. Refer to the PHPGurukul website for future updates and to the VulDB submission record for disclosure status. Organizations running Art Gallery Management System 1.0 should assume the codebase remains vulnerable and apply compensating controls.

Workarounds

Deploy a Content Security Policy header such as Content-Security-Policy: default-src 'self'; script-src 'self' to block inline script execution introduced through reflected input.
Add server-side input validation that rejects artname values containing HTML metacharacters or exceeding an allowlisted character set.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of successful script execution against authenticated sessions.

bash

# Example WAF rule (ModSecurity) blocking reflected XSS on artname
SecRule ARGS:artname "@rx (?i)(<script|onerror=|onload=|javascript:|%3Cscript)" \
    "id:1002645,phase:2,deny,status:403,\
     msg:'CVE-2025-2645 XSS attempt on product.php artname parameter'"