CVE-2025-41350: Iest Winplus Stored XSS Vulnerability

CVE-2025-41350 Overview

CVE-2025-41350 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in WinPlus v24.11.27, developed by Informática del Este. The flaw exists in the /WinplusPortal/ws/sWinplus.svc/json/savesoldoc_post endpoint, which fails to properly validate user input submitted through the descripcion parameter in POST requests. An authenticated attacker can inject malicious script content that is stored server-side and later executed in the browser of any user who views the affected page. Successful exploitation enables session cookie theft and impersonation of authenticated users.

Critical Impact
Attackers with low-privileged authenticated access can inject persistent JavaScript that executes in other users' browsers, enabling session hijacking and unauthorized access to WinPlus portal functions.

Affected Products

Informática del Este WinPlus version 24.11.27
WinPlus Portal web service (sWinplus.svc)
Deployments exposing the savesoldoc_post JSON endpoint

Discovery Timeline

2025-11-18 - CVE-2025-41350 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-41350

Vulnerability Analysis

The vulnerability resides in the WinPlus Portal SOAP/JSON web service handler at /WinplusPortal/ws/sWinplus.svc/json/savesoldoc_post. The endpoint accepts a descripcion field intended to store descriptive text associated with a document. The application persists the raw input to storage and later renders it into HTML responses without applying output encoding or context-aware sanitization.

Because the payload is stored, execution occurs whenever a legitimate user loads the affected view. This changes the exploitation model from a one-shot phishing lure to a persistent trap that fires against every viewer. Attackers can leverage this to exfiltrate session cookies, perform actions on behalf of victims, or pivot to internal application data.

The vulnerability requires user interaction and low-privileged authentication, but the scope extends beyond the attacker's own session because injected scripts execute in the context of other authenticated users.

Root Cause

The root cause is missing input validation and output encoding on the descripcion parameter processed by savesoldoc_post. The service treats user-supplied strings as trusted content and returns them within HTML contexts without escaping characters such as <, >, and ". This is a textbook instance of CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation follows this sequence: an authenticated attacker sends a POST request to the JSON endpoint with a descripcion value containing an HTML or JavaScript payload. The server stores the payload against the associated record. When another authenticated user opens the document view, the browser parses the payload as active markup and executes it under the origin of the WinPlus portal. Because session cookies for the portal are accessible to same-origin scripts, they can be exfiltrated to an attacker-controlled endpoint.

No verified public proof-of-concept code is available. See the INCIBE Security Notice on XSS in WinPlus for coordinated disclosure details.

Detection Methods for CVE-2025-41350

Indicators of Compromise

POST requests to /WinplusPortal/ws/sWinplus.svc/json/savesoldoc_post containing HTML tags, <script> fragments, javascript: URIs, or event handlers such as onerror= and onload= inside the descripcion parameter.
Outbound HTTP requests from user browsers to unknown external hosts immediately after loading WinPlus document views, indicating cookie exfiltration.
Stored records in the WinPlus database with descripcion field values containing angle brackets, encoded scripts, or base64-encoded payloads.

Detection Strategies

Inspect web server access logs for POST bodies to savesoldoc_post and flag entries whose descripcion field contains HTML metacharacters or script keywords.
Deploy a Web Application Firewall (WAF) rule that inspects JSON bodies for the descripcion key and blocks payloads matching common XSS signatures.
Query the WinPlus backend datastore for existing records whose descriptive fields contain <script, onerror=, onload=, or javascript: substrings to identify already-planted payloads.

Monitoring Recommendations

Enable full request-body logging on the WinPlus Portal web service and forward logs to a centralized SIEM for retention and correlation.
Configure browser-side alerting via Content Security Policy (CSP) report-uri directives to surface script execution attempts blocked by policy.
Monitor authenticated user sessions for anomalies such as concurrent logins from disparate IP addresses, which may indicate session hijacking following cookie theft.

How to Mitigate CVE-2025-41350

Immediate Actions Required

Contact Informática del Este to obtain a patched build of WinPlus that addresses the descripcion parameter handling in savesoldoc_post.
Restrict network access to the WinPlus Portal to trusted internal networks or VPN clients until a fix is applied.
Audit stored descripcion values across existing documents and sanitize or remove entries containing script content.
Force session invalidation and require re-authentication for all WinPlus users to invalidate any potentially stolen session tokens.

Patch Information

No vendor patch identifier is published in the NVD entry. Users of WinPlus v24.11.27 should track the INCIBE advisory and contact Informática del Este directly for a corrected release. Verify that any updated build applies context-aware output encoding on the descripcion field.

Workarounds

Deploy a reverse proxy or WAF rule that rejects POST requests to savesoldoc_post whose JSON body contains HTML metacharacters in the descripcion field.
Apply a strict Content Security Policy on the WinPlus Portal that disallows inline scripts and restricts script sources to a trusted allowlist, reducing the impact of injected payloads.
Set the HttpOnly and Secure flags on WinPlus session cookies to prevent JavaScript access and limit exposure to cookie theft.
Limit portal access to the minimum set of authenticated users required for business operations until the vendor releases a fix.

bash

# Example ModSecurity rule to block XSS payloads in the descripcion parameter
SecRule REQUEST_URI "@contains /WinplusPortal/ws/sWinplus.svc/json/savesoldoc_post" \
  "chain,phase:2,deny,status:403,id:1004135,\
   msg:'CVE-2025-41350 - Potential stored XSS in descripcion parameter'"
  SecRule REQUEST_BODY "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "t:none,t:urlDecode,t:htmlEntityDecode"