CVE-2025-40991: Ekushey Project Manager CRM XSS Vulnerability

CVE-2025-40991 Overview

CVE-2025-40991 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Ekushey Project Manager CRM version 5.0 by Creativeitem. The flaw resides in the /ekushey/index.php/client/project_file/upload/xxxx endpoint, where the description parameter submitted via HTTP POST is not properly validated or sanitized. An authenticated attacker can inject malicious JavaScript that executes in the browser of any user who views the affected content. Successful exploitation enables session cookie theft and account takeover of victims who interact with the crafted project file entry.

Critical Impact
Attackers with low-privilege authenticated access can inject persistent JavaScript payloads that steal session cookies and hijack accounts of users who view the compromised project file description.

Affected Products

Creativeitem Ekushey Project Manager CRM 5.0
Component: creativeitem:ekushey_project_manager_crm
Affected endpoint: /ekushey/index.php/client/project_file/upload/xxxx

Discovery Timeline

2025-10-02 - CVE-2025-40991 published to the National Vulnerability Database (NVD)
2026-10-12 - Last updated in NVD database

Technical Details for CVE-2025-40991

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the project file upload workflow of Ekushey CRM v5.0. The application accepts the description POST parameter without applying output encoding or input sanitization. The attacker-supplied payload is persisted in the application database and rendered to other users on subsequent page views. Because the payload executes within the authenticated session context of the victim, it can access and exfiltrate session cookies, perform actions on behalf of the user, and modify page content. The attack requires an authenticated low-privilege account on the CRM and user interaction from the victim to trigger execution.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The upload handler at /ekushey/index.php/client/project_file/upload/xxxx fails to sanitize HTML and JavaScript metacharacters in the description parameter. The stored data is later reflected into the DOM without context-appropriate encoding, allowing arbitrary script execution.

Attack Vector

The attack vector is network-based and requires an authenticated session on the CRM. An attacker submits a POST request to the vulnerable upload endpoint with a description field containing a JavaScript payload. When another authenticated user — typically an administrator or project collaborator — opens the project view, the payload executes in their browser. The attacker uses the executed script to send the victim's session cookie to an attacker-controlled host, enabling session hijacking.

No verified public proof-of-concept code is available for this issue. See the INCIBE CERT Notice on Vulnerabilities for the coordinated advisory.

Detection Methods for CVE-2025-40991

Indicators of Compromise

POST requests to /ekushey/index.php/client/project_file/upload/xxxx where the description parameter contains HTML tags such as <script>, <img>, <svg>, or event handlers like onerror= and onload=.
Outbound HTTP requests from user browsers to unexpected external hosts shortly after loading project file pages, consistent with cookie exfiltration.
Database records in project file description fields containing encoded script fragments or JavaScript URI schemes.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect POST bodies to the Ekushey upload endpoint for XSS signatures and encoded payloads.
Review application and web server access logs for unusual payload lengths or special characters in the description POST parameter.
Audit stored project file descriptions in the CRM database for persisted HTML or JavaScript content using pattern-matching queries.

Monitoring Recommendations

Enable verbose HTTP request logging on the Ekushey CRM web server, including POST body capture for the /client/project_file/upload/ path.
Monitor browser Content Security Policy (CSP) violation reports if CSP is deployed.
Alert on anomalous session activity such as concurrent logins from different geographies following access to compromised project pages.

How to Mitigate CVE-2025-40991

Immediate Actions Required

Restrict access to the Ekushey CRM to trusted networks until a vendor patch is applied.
Review all existing project file descriptions and remove any entries containing HTML tags or scripting content.
Rotate session cookies and force re-authentication for all CRM users to invalidate any already-stolen sessions.
Audit user accounts for unauthorized privilege changes or activity consistent with session hijacking.

Patch Information

No vendor patch URL is listed in the available advisory data at the time of publication. Monitor the INCIBE CERT Notice on Vulnerabilities and the Creativeitem product channels for a fixed release of Ekushey Project Manager CRM.

Workarounds

Deploy a WAF rule that blocks or strips HTML and JavaScript metacharacters in POST requests to /ekushey/index.php/client/project_file/upload/.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Limit CRM account provisioning and revoke access for untrusted or inactive users, since exploitation requires authenticated access.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of script-based cookie theft.

bash

# Example Nginx WAF-style rule to block script tags in the vulnerable parameter
location /ekushey/index.php/client/project_file/upload/ {
    if ($request_method = POST) {
        if ($request_body ~* "(<script|javascript:|onerror=|onload=)") {
            return 403;
        }
    }
    proxy_pass http://ekushey_backend;
}