CVE-2025-40695: Online Fire Reporting System XSS Vulnerability

CVE-2025-40695 Overview

CVE-2025-40695 is a stored Cross-Site Scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System version 1.2. The flaw exists in the /ofrs/admin/request-details.php endpoint, which fails to validate or sanitize the remark, status, and takeaction POST parameters. An authenticated attacker can inject persistent JavaScript payloads that execute in the browser of any administrator who views the affected request record. Successful exploitation enables session cookie theft, administrative account takeover, and pivoting into further web-based attacks against authenticated users.

Critical Impact

Authenticated attackers can inject persistent JavaScript into administrative request records, enabling session hijacking and administrator account compromise.

Affected Products

• PHPGurukul Online Fire Reporting System version 1.2
• Web deployments exposing /ofrs/admin/request-details.php
• Any downstream forks reusing the vulnerable admin request-handling logic

Discovery Timeline

• 2025-09-11 - CVE-2025-40695 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40695

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified under [CWE-79]. The request-details.php script in the admin console accepts POST input for remark, status, and takeaction without applying output encoding or input filtering. Submitted values are persisted to the database and later rendered directly into administrative HTML views.

When an administrator opens the affected request record, the browser parses attacker-controlled markup as executable JavaScript. The stored nature of the flaw means the payload fires on every page load, extending its blast radius beyond the initial attacker session. Because the vulnerable endpoint sits inside the admin panel, exploitation can hijack privileged sessions and lead to full application compromise.

Root Cause

The root cause is missing server-side input validation and missing contextual output encoding. The application concatenates untrusted POST parameters into HTML responses without functions such as htmlspecialchars() or a templating layer that escapes by default. No Content Security Policy (CSP) restricts inline script execution, so injected payloads run unimpeded in the admin browser context.

Attack Vector

Exploitation requires authenticated access to submit data to /ofrs/admin/request-details.php and user interaction from a victim administrator who subsequently views the record. An attacker with low-privilege credentials submits a crafted request containing JavaScript in the remark, status, or takeaction fields. The payload is stored server-side and executes in every administrator's browser session that renders the record, exposing document.cookie, CSRF tokens, and DOM contents.

No verified public proof-of-concept code is available. See the INCIBE Security Notice for coordinated advisory details.

Detection Methods for CVE-2025-40695

Indicators of Compromise

• Database rows in the fire request tables containing <script>, onerror=, onload=, or javascript: substrings within remark, status, or takeaction columns.
• Outbound HTTP requests from administrator browsers to unfamiliar domains carrying session cookie values in query strings.
• Unexpected administrative actions performed shortly after an admin viewed a submitted fire report.

Detection Strategies

• Inspect web server access logs for POST requests to /ofrs/admin/request-details.php containing URL-encoded HTML or script tags in the vulnerable parameters.
• Deploy Web Application Firewall (WAF) rules that flag HTML tags or JavaScript event handlers submitted through form fields intended for plain text.
• Run database queries against stored records to identify persisted markup and quarantine suspect entries before they render in the admin UI.

Monitoring Recommendations

• Enable verbose logging on the admin panel and forward events to a centralized SIEM for correlation with authentication and session activity.
• Alert on administrator session cookies appearing in referrer headers or outbound telemetry to third-party domains.
• Monitor for anomalous administrator behavior such as new user creation or configuration changes following the viewing of user-submitted records.

How to Mitigate CVE-2025-40695

Immediate Actions Required

• Restrict access to the /ofrs/admin/ directory using network controls or authentication proxies until sanitization is applied.
• Audit stored fire request records and purge any entries containing HTML or script content in the remark, status, or takeaction fields.
• Force a password reset and session invalidation for all administrator accounts that may have viewed malicious records.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for PHPGurukul Online Fire Reporting System version 1.2. Administrators should track the INCIBE Security Notice for vendor updates and apply fixes once released.

Workarounds

• Apply server-side input validation that rejects HTML characters in the remark, status, and takeaction parameters, or encode output with htmlspecialchars($value, ENT_QUOTES, 'UTF-8') before rendering.
• Deploy a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins.
• Place the admin console behind an authenticating reverse proxy and enforce IP allow-listing to limit exposure to trusted operators.

# Example CSP header to block inline script execution in the admin panel
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"