CVE-2025-40990: Ekushey Project Manager CRM XSS Vulnerability

CVE-2025-40990 Overview

CVE-2025-40990 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Ekushey Project Manager CRM v5.0 by Creativeitem. The flaw resides in the /ekushey/index.php/client/project_bug/create/xxx endpoint, where the title and description POST parameters lack proper input validation and output encoding. An authenticated attacker can inject malicious JavaScript that executes in the browser of any user who subsequently views the affected project bug entry. Successful exploitation enables session cookie theft, account impersonation, and client-side actions performed in the victim's authenticated context.

Critical Impact
An authenticated attacker can store malicious JavaScript in the bug tracker that executes against other users, enabling session hijacking and unauthorized actions in the victim's session context.

Affected Products

Creativeitem Ekushey Project Manager CRM 5.0
/ekushey/index.php/client/project_bug/create/xxx endpoint
title and description POST parameters

Discovery Timeline

2025-10-02 - CVE-2025-40990 published to NVD
2026-10-12 - Last updated in NVD database

Technical Details for CVE-2025-40990

Vulnerability Analysis

The vulnerability is a stored (persistent) XSS flaw in the project bug creation workflow of Ekushey Project Manager CRM v5.0. When an authenticated user submits a bug report through the /ekushey/index.php/client/project_bug/create/xxx endpoint, the application accepts the title and description POST parameters without sanitizing or encoding HTML and JavaScript payloads. The injected content is persisted in the application database. When any user later renders the project bug list or detail view, the server returns the attacker-controlled payload inside the HTML response, and the browser executes it in the context of the application origin.

Because the payload is stored server-side, exploitation does not require social engineering of a specific URL. Any legitimate user who views the affected bug record will trigger the script.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The application fails to apply contextual output encoding when rendering user-supplied title and description values. There is no server-side allowlist filtering, no HTML entity encoding on output, and no Content Security Policy (CSP) to limit inline script execution.

Attack Vector

Exploitation requires network access to the application and valid low-privileged credentials. The attacker authenticates to the CRM, navigates to the project bug creation form, and submits a crafted payload in the title or description field. A payload such as a script tag or an event handler on an HTML element is stored in the database. When a victim views the bug record, the payload executes and can exfiltrate document.cookie, perform CSRF-style actions against the CRM, or redirect the victim to an attacker-controlled host. User interaction (viewing the record) is required to trigger execution.

No verified public proof-of-concept code is available for this issue. For technical details, refer to the INCIBE Security Notice: Creativeitem Vulnerabilities.

Detection Methods for CVE-2025-40990

Indicators of Compromise

Project bug records containing HTML tags such as <script>, <img onerror=...>, <svg onload=...>, or javascript: URIs in the title or description fields.
Outbound HTTP requests from client browsers to unexpected external domains shortly after loading a project bug page.
Unexpected session reuse from new IP addresses or user agents following access to a project bug view.

Detection Strategies

Review database contents of the project bug table for stored HTML or JavaScript syntax in text fields.
Inspect web server access logs for POST requests to /ekushey/index.php/client/project_bug/create/ with payload bodies containing script-related tokens.
Deploy a web application firewall (WAF) rule to flag XSS signatures submitted to the bug creation endpoint.

Monitoring Recommendations

Alert on anomalous Content-Length values or encoded payloads (%3Cscript%3E, base64-encoded JavaScript) in POST bodies to the vulnerable path.
Monitor authenticated session activity for cookie reuse across distinct source IP addresses.
Enable browser-side CSP violation reporting to capture blocked inline script execution attempts.

How to Mitigate CVE-2025-40990

Immediate Actions Required

Restrict access to the Ekushey CRM to trusted networks or require VPN access while a vendor fix is pending.
Audit existing project bug records and remove any entries containing HTML or JavaScript syntax in the title or description fields.
Rotate active session identifiers and force reauthentication for all users to invalidate any potentially stolen sessions.

Patch Information

At the time of publication, no vendor security patch is referenced in the NVD entry for CVE-2025-40990. Monitor the Creativeitem product channels and the INCIBE advisory for fix availability and apply updates as soon as they are released.

Workarounds

Deploy a WAF rule in front of the application to block requests to /ekushey/index.php/client/project_bug/create/ containing script tags, event handlers, or javascript: URIs.
Enforce a strict Content Security Policy that disallows inline scripts (script-src 'self') to reduce the impact of stored payloads.
Set the HttpOnly and Secure attributes on session cookies to prevent JavaScript access and transport over plaintext channels.
Limit project bug creation privileges to vetted accounts until the application is patched.

bash

# Example nginx WAF-style rule to block obvious XSS payloads on the vulnerable endpoint
location ~* /ekushey/index.php/client/project_bug/create/ {
    if ($request_method = POST) {
        set $block 0;
        if ($request_body ~* "(<script|onerror=|onload=|javascript:)") { set $block 1; }
        if ($block = 1) { return 403; }
    }
    proxy_pass http://ekushey_backend;
}

# Example response header hardening
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;
add_header X-Content-Type-Options "nosniff" always;