CVE-2025-5378: Astun iShare Maps XSS Vulnerability

CVE-2025-5378 Overview

CVE-2025-5378 is a reflected cross-site scripting (XSS) vulnerability in Astun Technology iShare Maps 5.4.0. The flaw resides in the mycouncil2.aspx file, where the atTxtStreet parameter accepts unsanitized input. Attackers can inject arbitrary JavaScript that executes in the victim's browser session. The vulnerability is exploitable remotely and requires user interaction, such as clicking a crafted link. Public disclosure has occurred, and the vendor did not respond to early notification attempts. The issue is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can execute arbitrary JavaScript in the context of authenticated iShare Maps users, potentially enabling session theft, credential harvesting, or unauthorized actions against council mapping services.

Affected Products

Astun Technology iShare Maps 5.4.0
Component: mycouncil2.aspx
Parameter: atTxtStreet

Discovery Timeline

2025-05-31 - CVE-2025-5378 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5378

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the mycouncil2.aspx endpoint of iShare Maps 5.4.0. The application accepts user-supplied input through the atTxtStreet query parameter and reflects it into the HTTP response without adequate output encoding or input sanitization. When an attacker crafts a URL containing malicious script content in this parameter and lures a user into visiting it, the browser executes the injected code in the security context of the iShare Maps origin.

Because iShare Maps is commonly deployed as a public-facing web mapping platform for local government councils, successful exploitation can affect authenticated administrators, staff, and general users. The EPSS probability for this vulnerability is 0.306%, placing it in the 22.7 percentile of tracked CVEs.

Root Cause

The root cause is missing output encoding of the atTxtStreet request parameter before it is embedded into the server-rendered HTML response. The application trusts client-supplied data and reflects it verbatim, violating the principle of contextual output encoding for HTML, attribute, and JavaScript contexts. This is a textbook [CWE-79] pattern.

Attack Vector

Exploitation follows the standard reflected XSS pattern. An attacker crafts a URL of the form https://<target>/mycouncil2.aspx?atTxtStreet=<payload> where <payload> contains JavaScript such as an inline <script> block or an event handler injected into an existing HTML attribute. The attacker delivers this link via phishing email, malicious website, or social media. When the victim clicks the link, the payload executes in their browser with access to cookies, session tokens, and DOM contents of the iShare Maps application.

The attack requires user interaction but no authentication or elevated privileges on the target application.

Detection Methods for CVE-2025-5378

Indicators of Compromise

HTTP requests to mycouncil2.aspx containing script tags, javascript: URIs, or event handler attributes in the atTxtStreet parameter
URL-encoded payloads such as %3Cscript%3E, %3Cimg%20, or onerror%3D within the query string
Referrer headers pointing to external phishing domains preceding requests to the vulnerable endpoint
Unexpected outbound requests from user browsers to attacker-controlled domains following iShare Maps sessions

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the atTxtStreet parameter for HTML tags, JavaScript keywords, and encoded script markers
Enable verbose IIS or reverse proxy logging on mycouncil2.aspx and alert on requests containing suspicious meta-characters
Correlate authentication events with anomalous XSS-pattern requests to identify targeted account compromise attempts

Monitoring Recommendations

Aggregate iShare Maps web server logs into a centralized log platform and build queries for reflected XSS signatures against the affected endpoint
Monitor client-side Content Security Policy (CSP) violation reports to identify injected script execution attempts
Track user-agent and geolocation anomalies on requests to mycouncil2.aspx to spot campaign-driven exploitation

How to Mitigate CVE-2025-5378

Immediate Actions Required

Restrict access to mycouncil2.aspx at the network or reverse proxy layer where feasible until a fix is available
Deploy WAF signatures blocking script content, HTML tag characters, and common XSS payloads in the atTxtStreet parameter
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources on the iShare Maps application
Notify users and administrators to avoid clicking untrusted links referencing the iShare Maps domain

Patch Information

At the time of publication, no vendor patch has been referenced in the NVD entry. Astun Technology was contacted about the disclosure but did not respond. Administrators should monitor the VulDB entry for CVE-2025-5378 and the vendor's official communication channels for future security updates.

Workarounds

Implement server-side or WAF-based input validation that rejects HTML meta-characters (<, >, ", ') in the atTxtStreet parameter
Set the HttpOnly and Secure flags on session cookies to reduce the impact of successful script execution
Deploy a Content Security Policy header such as Content-Security-Policy: default-src 'self'; script-src 'self' on responses from mycouncil2.aspx
Enable browser XSS auditing features and modern anti-clickjacking headers (X-Frame-Options, Referrer-Policy) across the application

bash

# Example WAF rule (ModSecurity) blocking reflected XSS on atTxtStreet
SecRule ARGS:atTxtStreet "@rx (?i)(<script|javascript:|onerror=|onload=|<img|<svg)" \
    "id:1005378,\
     phase:2,\
     deny,\
     status:403,\
     log,\
     msg:'CVE-2025-5378 XSS attempt against iShare Maps mycouncil2.aspx'"