CVE-2025-40989: Ekushey Project Manager CRM XSS Vulnerability

CVE-2025-40989 Overview

CVE-2025-40989 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in Ekushey Project Manager CRM v5.0 by Creativeitem. The flaw resides in the /ekushey/index.php/client/project_message/add/xxx endpoint, where the message parameter submitted via POST is not properly validated or sanitized. An authenticated attacker can inject persistent JavaScript payloads that execute in the browser of any user viewing the affected project message. Successful exploitation enables session cookie theft, account hijacking, and further client-side attacks against authenticated users of the CRM platform.

Critical Impact
Authenticated attackers can inject persistent JavaScript into project messages, enabling session hijacking and impersonation of other Ekushey CRM users.

Affected Products

Creativeitem Ekushey Project Manager CRM 5.0
Deployments exposing the /ekushey/index.php/client/project_message/add/ endpoint
Any downstream instances built on the vulnerable v5.0 codebase

Discovery Timeline

2025-10-02 - CVE-2025-40989 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40989

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw in the client project messaging feature of Ekushey Project Manager CRM. When an authenticated user submits a message to a project via POST to /ekushey/index.php/client/project_message/add/xxx, the application accepts the message parameter without sufficient input filtering or output encoding.

Because the payload is persisted in the application database and rendered to other users who load the project message thread, the injected script executes in every viewer's browser session. This shifts the attack surface from a single victim (as in reflected XSS) to any authenticated user who accesses the compromised project.

Exploitation requires low-privilege authentication and some user interaction, since a victim must load the message view. The impact is bounded to the browser context of the CRM but includes theft of session tokens, cross-site request execution, and defacement of the CRM interface.

Root Cause

The root cause is missing server-side input validation and missing context-aware output encoding on the message parameter. The application trusts client-supplied content and stores it verbatim, then reflects it into HTML without escaping characters such as <, >, ", and '. This is a canonical instance of CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation follows a standard stored XSS workflow. An authenticated attacker sends a POST request to the project message endpoint with a message body containing an HTML or JavaScript payload, for example a <script> tag or event-handler attribute that exfiltrates document.cookie to an attacker-controlled host. The payload is stored server-side. When a second authenticated user opens the affected project message thread, the browser parses and executes the injected script under the CRM's origin. The attacker can then hijack the session, perform actions on behalf of the victim, or pivot to additional CRM functionality. See the INCIBE advisory for additional technical detail.

Detection Methods for CVE-2025-40989

Indicators of Compromise

POST requests to /ekushey/index.php/client/project_message/add/ containing <script>, onerror=, onload=, javascript:, or encoded variants in the message parameter
Outbound HTTP requests from client browsers to unfamiliar domains shortly after loading a project message page
Stored project messages in the database containing HTML tags or JavaScript event handlers
Anomalous session reuse from geographically distant IP addresses following a user's visit to the messaging module

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects POST bodies to the project message endpoint for XSS signatures and encoded payloads
Review web server access logs for POST requests to project_message/add/ with abnormally long or script-like message values
Query the CRM database for stored messages containing <script, onerror, onload, <iframe, or <svg substrings
Enable Content Security Policy (CSP) violation reporting to surface unauthorized script execution in the browser

Monitoring Recommendations

Correlate authentication events with subsequent session activity to identify session token reuse indicative of cookie theft
Alert on any modification to the project_message table containing HTML control characters
Monitor browser telemetry for unexpected outbound requests originating from the CRM domain

How to Mitigate CVE-2025-40989

Immediate Actions Required

Restrict access to the Ekushey CRM instance to trusted networks or place it behind a VPN until a vendor fix is available
Audit stored project messages for existing malicious payloads and purge any confirmed injections
Rotate session secrets and force reauthentication for all users to invalidate any hijacked sessions
Contact Creativeitem for guidance on a patched release addressing the message parameter validation gap

Patch Information

At the time of the NVD publication on 2025-10-02, no vendor patch is referenced in the advisory data. Consult the INCIBE notice on Creativeitem product vulnerabilities and Creativeitem support channels for release information. Upgrade to any vendor-supplied version newer than 5.0 that documents remediation of this issue.

Workarounds

Deploy a WAF rule that blocks or sanitizes HTML metacharacters in the message POST parameter on the affected endpoint
Enforce a strict Content Security Policy that disables inline scripts and restricts script sources to trusted origins
Set the HttpOnly and Secure flags on all session cookies to reduce the impact of script-based cookie theft
Limit CRM user permissions so that low-privilege client accounts cannot post to shared project threads viewed by administrators

bash

# Example nginx rule to block obvious XSS payloads on the vulnerable endpoint
location ~* /ekushey/index.php/client/project_message/add/ {
    if ($request_method = POST) {
        set $block 0;
        if ($request_body ~* "(<script|onerror=|onload=|javascript:|<iframe|<svg)") {
            set $block 1;
        }
        if ($block = 1) { return 403; }
    }
    proxy_pass http://ekushey_backend;
}