CVE-2025-40693: Online Fire Reporting System XSS Vulnerability

CVE-2025-40693 Overview

CVE-2025-40693 is a stored and reflected Cross-Site Scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System version 1.2. The flaw resides in the /ofrs/admin/edit-team.php endpoint, which fails to properly validate user-supplied input. An authenticated attacker can inject malicious JavaScript through the tname parameter via GET requests, or through the teamleadname, teammember, and teamname parameters via POST requests. Successful exploitation allows an attacker to execute arbitrary script in the context of another authenticated user's browser session, enabling session cookie theft and account takeover of administrative users.

Critical Impact
An authenticated attacker can persist malicious JavaScript that executes in administrator browsers, leading to session hijacking and unauthorized administrative access.

Affected Products

PHPGurukul Online Fire Reporting System 1.2
/ofrs/admin/edit-team.php administrative endpoint
Deployments exposing the admin panel to untrusted networks

Discovery Timeline

2025-09-11 - CVE-2025-40693 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40693

Vulnerability Analysis

The vulnerability is classified as Cross-Site Scripting under [CWE-79]. The affected edit-team.php script accepts multiple user-controlled parameters without applying output encoding or input sanitization. The tname GET parameter reflects directly into the HTML response, producing a reflected XSS condition. The teamleadname, teammember, and teamname POST parameters are persisted to the backend database and later rendered in administrative views, producing stored XSS.

Because the injection point resides within an authenticated admin workflow, exploitation typically requires social engineering of an authenticated user or leveraging an already-compromised low-privilege account. Once injected, the payload executes in the security context of the victim's browser under the application's origin, providing access to session cookies, DOM content, and privileged actions the user can perform.

Root Cause

The root cause is missing input validation and output encoding on the edit-team.php handler. User-supplied strings are concatenated into HTML output without HTML entity encoding, and stored values are not sanitized before persistence. PHPGurukul's code path lacks contextual escaping functions such as htmlspecialchars() around reflected and stored fields.

Attack Vector

Exploitation occurs over the network against an authenticated administrator session. An attacker with valid low-privilege credentials submits a crafted payload through the vulnerable POST parameters, planting persistent script in team records. Alternatively, the attacker delivers a malicious link containing a crafted tname GET parameter to an authenticated user. When an administrator loads the affected page, the payload executes and can exfiltrate document.cookie values to an attacker-controlled endpoint, enabling session takeover.

Refer to the INCIBE Notice on PHPGurukul Vulnerabilities for the vendor-adjacent disclosure details.

Detection Methods for CVE-2025-40693

Indicators of Compromise

HTTP requests to /ofrs/admin/edit-team.php containing <script>, onerror=, onload=, or javascript: substrings in the tname, teamleadname, teammember, or teamname parameters.
Outbound HTTP requests from admin browsers to unrecognized domains shortly after loading the team management page.
Unexpected new team records containing HTML tags or JavaScript event handlers in stored fields.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule to inspect GET and POST bodies to edit-team.php for HTML tags and JavaScript event handler patterns.
Review application access logs for anomalous parameter values submitted by low-privilege accounts.
Enable Content Security Policy (CSP) reporting to surface script executions from unexpected sources.

Monitoring Recommendations

Alert on repeated POST submissions to edit-team.php from a single session within short time windows.
Monitor admin session cookies for reuse from multiple IP addresses or user agents.
Track database changes to team-related tables and flag entries containing angle brackets or javascript: schemes.

How to Mitigate CVE-2025-40693

Immediate Actions Required

Restrict access to the /ofrs/admin/ directory to trusted management IP ranges using web server access controls.
Audit existing team records for stored payloads and remove any entries containing HTML or script content.
Rotate administrator credentials and invalidate active sessions if suspicious entries are found.
Enforce short session lifetimes and set the HttpOnly and Secure flags on session cookies to limit theft impact.

Patch Information

No official vendor patch is referenced in the CVE record at the time of publication. Consult the INCIBE Notice on PHPGurukul Vulnerabilities for updates from PHPGurukul. Until a fix is available, apply the workarounds below and consider suspending use of the affected version in production.

Workarounds

Apply htmlspecialchars($input, ENT_QUOTES, 'UTF-8') around all reflected and stored outputs in edit-team.php as a source-code hotfix.
Add server-side input validation rejecting characters <, >, ", ', and backticks in the tname, teamleadname, teammember, and teamname parameters.
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Place the application behind a WAF with XSS signatures enabled until the vendor releases a patched release.

bash

# Example nginx configuration to enforce a restrictive CSP header
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;