CVE-2025-40694: PHPGurukul Fire Reporting System XSS Flaw

CVE-2025-40694 Overview

CVE-2025-40694 is a stored cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System version 1.2. The flaw resides in the /ofrs/admin/bwdates-report-result.php endpoint, where the application fails to validate or sanitize the fromdate and todate POST parameters. An authenticated attacker can inject persistent JavaScript payloads that execute in the browser of any administrator viewing the affected report page. The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation enables session cookie theft, administrative account hijacking, and unauthorized actions within the fire reporting application.

Affected Products

PHPGurukul Online Fire Reporting System 1.2
Deployments exposing the /ofrs/admin/bwdates-report-result.php endpoint
Any downstream integrations relying on the admin reporting interface

Discovery Timeline

2025-09-11 - CVE-2025-40694 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40694

Vulnerability Analysis

The vulnerability exists in the date-range reporting workflow of the administrator panel. When an authenticated user submits a report query, the fromdate and todate POST parameters are reflected and stored without proper input validation or output encoding. Any HTML or JavaScript content supplied in these parameters is rendered within the resulting report page, executing in the context of the victim's authenticated session.

Because the payload persists in server-side state, the injected script fires each time an administrator views the affected report. This behavior distinguishes the flaw from reflected XSS, since a single injection can compromise multiple sessions over time. The attack requires prior authentication and user interaction from the victim to trigger execution.

Root Cause

The root cause is missing input validation and output sanitization on the fromdate and todate POST parameters received by bwdates-report-result.php. The PHP handler concatenates the parameter values directly into the HTML response without applying htmlspecialchars(), context-aware encoding, or an allowlist for date-formatted input. This omission permits arbitrary HTML and script content to reach the DOM of the rendered admin page.

Attack Vector

Exploitation requires network access to the vulnerable endpoint and authenticated privileges in the application. An attacker submits a crafted POST request containing JavaScript payloads in the fromdate or todate parameters. When another authenticated administrator loads the resulting report view, the payload executes and can exfiltrate session cookies, perform actions on behalf of the victim, or pivot to further application resources. Full technical details are documented in the INCIBE Security Notice.

Detection Methods for CVE-2025-40694

Indicators of Compromise

POST requests to /ofrs/admin/bwdates-report-result.php with fromdate or todate parameter values containing <script>, onerror=, onload=, or JavaScript URI schemes.
Outbound HTTP requests from administrator browsers to unfamiliar hosts immediately after loading the report page.
Anomalous session activity such as admin actions originating from unexpected IP addresses or user agents.

Detection Strategies

Deploy web application firewall rules that inspect POST bodies for HTML tags or script constructs in date parameters.
Correlate application logs with reverse proxy telemetry to flag report requests containing non date-formatted values.
Baseline expected fromdate and todate formats and alert on any deviations from YYYY-MM-DD patterns.

Monitoring Recommendations

Enable verbose logging on the PHPGurukul admin subtree and forward events to a centralized SIEM.
Monitor administrator session cookies for reuse from multiple client fingerprints.
Track browser Content Security Policy violation reports to surface script execution attempts on admin pages.

How to Mitigate CVE-2025-40694

Immediate Actions Required

Restrict administrative access to the fire reporting application via VPN or IP allowlisting until a patch is applied.
Rotate all administrator credentials and invalidate active sessions to eliminate stolen tokens.
Audit bwdates-report-result.php request logs for suspicious fromdate and todate values indicative of prior injection.

Patch Information

No vendor patch is currently listed for CVE-2025-40694 in the enriched data. Administrators should monitor PHPGurukul channels and the INCIBE Security Notice for updates. Until a fix is published, apply the workarounds below.

Workarounds

Add server-side validation that rejects any fromdate or todate value not matching a strict date regex such as ^\d{4}-\d{2}-\d{2}$.
Apply htmlspecialchars($value, ENT_QUOTES, 'UTF-8') to all user-supplied values before rendering them in HTML output.
Deploy a strict Content Security Policy that disables inline scripts on administrative pages.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of successful script execution.

bash

# Configuration example: Apache mod_security rule blocking script tags in date parameters
SecRule ARGS:fromdate|ARGS:todate "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1004069,phase:2,deny,status:403,log,msg:'CVE-2025-40694 XSS attempt blocked'"