CVE-2025-41001: SOPlanning Stored XSS Vulnerability

CVE-2025-41001 Overview

CVE-2025-41001 is a stored Cross-Site Scripting (XSS) vulnerability in SOPlanning v1.53.02, an open-source online planning tool. The flaw resides in /soplanning/www/process/options.php, where the application fails to validate or sanitize the LOGOUT_REDIRECT POST parameter. An authenticated attacker can inject arbitrary JavaScript that is persistently stored and executed in the browser of any user who accesses the affected functionality. Successful exploitation allows the attacker to hijack session cookies, perform actions on behalf of victims, or redirect users to attacker-controlled resources. The weakness is tracked as CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers with authenticated access can inject persistent JavaScript into SOPlanning, enabling session theft and account takeover against other authenticated users.

Affected Products

SOPlanning 1.53.02
Component: soplanning:soplanning
Affected endpoint: /soplanning/www/process/options.php

Discovery Timeline

2025-11-10 - CVE-2025-41001 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-41001

Vulnerability Analysis

The vulnerability is a stored XSS condition in the options management handler of SOPlanning. When an authenticated user submits a POST request to /soplanning/www/process/options.php, the LOGOUT_REDIRECT parameter is accepted and persisted without proper encoding or validation. The stored value is later rendered in a page context where the browser interprets injected markup as executable script.

Because the payload is stored server-side, any subsequent user who loads a page that renders the LOGOUT_REDIRECT value will execute the attacker's JavaScript. This enables theft of session cookies, forced actions through the authenticated session, and client-side redirection. The scope impact extends beyond the attacker's own session, affecting other users of the planning application.

Root Cause

The root cause is missing input validation and output encoding on the LOGOUT_REDIRECT field. User-supplied data is written to persistent storage and later reflected into HTML or JavaScript contexts without contextual escaping. This maps directly to CWE-79.

Attack Vector

Exploitation requires network access to the SOPlanning instance and valid low-privilege credentials. The attacker crafts a POST request containing a malicious JavaScript payload in the LOGOUT_REDIRECT parameter. Once stored, the payload executes in the browser of any authenticated user whose session renders that field. User interaction such as navigating to the affected page is required to trigger execution. See the INCIBE Security Notice for additional context.

Detection Methods for CVE-2025-41001

Indicators of Compromise

POST requests to /soplanning/www/process/options.php containing <script>, onerror=, onload=, or JavaScript URI schemes in the LOGOUT_REDIRECT parameter.
Unexpected outbound HTTP requests from authenticated user browsers to external domains shortly after loading SOPlanning pages.
Session cookies observed in server logs or proxy telemetry transmitted to third-party endpoints.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST bodies to options.php and flag HTML or JavaScript control characters in the LOGOUT_REDIRECT field.
Review SOPlanning database tables for stored option values containing <, >, javascript:, or event handler attributes.
Correlate authenticated user requests with anomalous Content Security Policy (CSP) violation reports if CSP is deployed.

Monitoring Recommendations

Enable verbose HTTP access logging on the SOPlanning web server and forward logs to a centralized analytics platform for query and alerting.
Monitor for repeated administrative option modifications originating from the same low-privilege account.
Track browser-side CSP violation reports to surface injected script execution attempts.

How to Mitigate CVE-2025-41001

Immediate Actions Required

Restrict network access to the SOPlanning application to trusted users and networks until a patched release is deployed.
Audit SOPlanning user accounts and revoke credentials that are no longer required, enforcing least privilege.
Inspect stored configuration values for injected script content and sanitize or revert any malicious entries.

Patch Information

At the time of publication, no vendor patch URL is listed in the NVD entry for SOPlanning 1.53.02. Monitor the INCIBE Security Notice and the SOPlanning project site for an updated release that addresses the LOGOUT_REDIRECT input handling in /soplanning/www/process/options.php.

Workarounds

Deploy a WAF rule to block or sanitize POST parameters to /soplanning/www/process/options.php that contain HTML tags, JavaScript URI schemes, or event handler attributes.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Require administrators to log out and clear browser sessions after interacting with suspicious SOPlanning content, and rotate session secrets if compromise is suspected.

bash

# Example ModSecurity-style rule to block script content in LOGOUT_REDIRECT
SecRule REQUEST_URI "@endsWith /soplanning/www/process/options.php" \
    "phase:2,chain,deny,status:403,id:1041001,msg:'CVE-2025-41001 XSS attempt'"
    SecRule ARGS:LOGOUT_REDIRECT "@rx (?i)(<script|javascript:|on\w+\s*=)" "t:none"