CVE-2025-40696: Online Fire Reporting System XSS Vulnerability

CVE-2025-40696 Overview

CVE-2025-40696 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in PHPGurukul Online Fire Reporting System version 1.2. The flaw resides in the /ofrs/reporting.php endpoint, which fails to validate or sanitize the fullname, location, and message POST parameters. An authenticated attacker can inject JavaScript payloads that execute in the browser of any user who views the stored content. Successful exploitation enables session cookie theft, account impersonation, and further client-side attacks against application users.

Critical Impact

Authenticated attackers can inject persistent JavaScript into fire reports, enabling session hijacking against administrators and other users of the Online Fire Reporting System.

Affected Products

• PHPGurukul Online Fire Reporting System version 1.2
• Deployments exposing the /ofrs/reporting.php endpoint
• Any instance running the vulnerable reporting.php handler without input sanitization

Discovery Timeline

• 2025-09-11 - CVE-2025-40696 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40696

Vulnerability Analysis

The vulnerability is a stored XSS in the fire reporting workflow of the Online Fire Reporting System. The reporting.php endpoint accepts user-submitted content through the fullname, location, and message POST parameters. The application stores these values in its backend database and later renders them in HTML responses without output encoding. Any script injected into these fields persists across sessions and executes whenever an authenticated user loads the affected page.

Because the payload is stored server-side, exploitation does not require social engineering of each victim. An attacker only needs one submission to compromise every subsequent viewer. Administrators who review reports become high-value targets, as their session cookies grant elevated access to the application.

Root Cause

The root cause is missing input validation and output encoding on the fullname, location, and message parameters processed by /ofrs/reporting.php. The application neither filters HTML metacharacters on input nor applies context-aware escaping on output, which allows arbitrary HTML and JavaScript to render in the application DOM.

Attack Vector

Exploitation requires network access to the application and valid low-privileged credentials. The attacker submits a crafted POST request to /ofrs/reporting.php containing a JavaScript payload inside the vulnerable parameters. When a second authenticated user, including an administrator, views the stored report, the injected script executes under the application origin and can exfiltrate document.cookie or perform actions on behalf of the victim.

No verified public proof-of-concept code is available. See the INCIBE Security Notice on PHPGurukul's Vulnerabilities for the vendor-independent advisory.

Detection Methods for CVE-2025-40696

Indicators of Compromise

• POST requests to /ofrs/reporting.php containing <script>, onerror=, onload=, or javascript: sequences in the fullname, location, or message parameters.
• Outbound HTTP requests from user browsers to attacker-controlled hosts shortly after rendering fire reports.
• Unexpected session reuse or administrator actions originating from new IP addresses after a report was viewed.

Detection Strategies

• Deploy web application firewall rules that inspect POST bodies to /ofrs/reporting.php for HTML tags and JavaScript event handlers.
• Review database records in the fire reporting tables for stored HTML markup in free-text fields.
• Correlate web server access logs with authentication logs to identify suspicious submissions followed by administrator cookie activity.

Monitoring Recommendations

• Enable verbose logging on the PHP application and capture full request bodies for the reporting.php endpoint.
• Monitor browser Content Security Policy (CSP) violation reports for inline script execution attempts.
• Alert on anomalous session activity, such as cookie use from geographically distant locations within short time windows.

How to Mitigate CVE-2025-40696

Immediate Actions Required

• Restrict access to the Online Fire Reporting System to trusted networks until a patched build is available.
• Audit the fire reports database and remove any entries containing HTML or script content from the affected fields.
• Rotate session cookies and force reauthentication for all administrative accounts.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2025-40696 at the time of writing. Operators should track the INCIBE Security Notice on PHPGurukul's Vulnerabilities and PHPGurukul release notes for an updated version beyond 1.2.

Workarounds

• Add server-side input validation that rejects HTML metacharacters in the fullname, location, and message parameters.
• Apply context-aware output encoding, such as htmlspecialchars($value, ENT_QUOTES, 'UTF-8'), when rendering stored report content.
• Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
• Place the application behind a WAF with signatures tuned for stored XSS payloads.

# Example Content Security Policy header to limit XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'"