CVE-2025-60948: Census CSWeb Stored XSS Vulnerability

CVE-2025-60948 Overview

Census CSWeb version 8.0.1 is affected by a stored cross-site scripting (XSS) vulnerability in user-supplied input fields. A remote, authenticated attacker can inject malicious JavaScript code that persists within the application and executes in the browser of any victim who views the affected content. This type of stored XSS vulnerability is particularly dangerous as the malicious payload persists server-side, potentially affecting multiple users over time.

Critical Impact
Authenticated attackers can inject persistent malicious scripts that execute in victim browsers, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of legitimate users.

Affected Products

CSPro Users CSWeb version 8.0.1
Census CSWeb 8 data collection and processing platform

Discovery Timeline

2026-03-23 - CVE-2025-60948 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2025-60948

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) exists in Census CSWeb 8.0.1 due to insufficient sanitization of user-supplied input fields. The application fails to properly encode or validate user input before storing it in the database and subsequently rendering it in web pages. When victims access pages containing the injected content, the malicious JavaScript executes within their browser context, inheriting their session privileges and access permissions.

The attack requires network access and an authenticated session on the CSWeb platform. User interaction is required as the victim must navigate to a page containing the stored malicious payload. While the confidentiality and integrity impacts are limited in scope to the affected user's browser session, the persistent nature of the attack means multiple users could be compromised over time.

Root Cause

The root cause of CVE-2025-60948 is improper input validation and output encoding in CSWeb's handling of user-supplied form fields. The application stores user input directly in the database without adequate sanitization and then renders this content in HTML responses without proper encoding, allowing injected JavaScript to execute as trusted code within the application's origin.

Attack Vector

An authenticated attacker exploits this vulnerability by injecting malicious JavaScript code into vulnerable user input fields within the CSWeb application. The attack follows a typical stored XSS pattern:

The attacker authenticates to the CSWeb application with valid credentials
The attacker submits malicious JavaScript payload through a vulnerable input field (such as user profile information, survey data, or other user-controlled content)
The application stores the unvalidated payload in its database
When another user or administrator views the page containing this stored content, the malicious script executes in their browser
The script can then perform actions such as stealing session cookies, capturing keystrokes, redirecting to phishing sites, or performing unauthorized operations

The vulnerability leverages network-based access with low attack complexity, though it requires prior authentication and victim interaction.

Detection Methods for CVE-2025-60948

Indicators of Compromise

Unusual JavaScript patterns in stored database content or application logs, particularly <script> tags or event handlers in user-supplied fields
Unexpected HTTP requests originating from user browsers to external domains
Session token exfiltration attempts visible in network traffic analysis
User reports of unexpected browser behavior when accessing CSWeb application pages

Detection Strategies

Implement web application firewall (WAF) rules to detect and block common XSS payload patterns in incoming requests
Deploy content security policy (CSP) headers to restrict script execution sources and detect policy violations
Monitor application logs for submissions containing HTML tags, JavaScript keywords, or URL-encoded script elements
Conduct regular security scans of the CSWeb application to identify stored XSS payloads in the database

Monitoring Recommendations

Enable detailed logging of all user input submissions to CSWeb form fields
Configure browser-based CSP violation reporting to capture attempted XSS exploitation
Monitor for anomalous session activity that may indicate session hijacking following XSS attacks
Review database content periodically for suspicious patterns that may indicate stored malicious payloads

How to Mitigate CVE-2025-60948

Immediate Actions Required

Upgrade CSWeb to version 8.1.0 alpha or later, which includes the security fix for this vulnerability
Review stored data in affected CSWeb deployments for potentially malicious content injected prior to patching
Implement Content Security Policy (CSP) headers to restrict inline script execution as a defense-in-depth measure
Consider forcing session invalidation for all users after patching to mitigate any ongoing session compromise

Patch Information

The vendor has addressed this vulnerability in CSWeb version 8.1.0 alpha. The fix is available in the CSWeb GitHub commit eba0b59a. Organizations should upgrade to the patched version as soon as possible.

Additional technical references are available in the GitHub CSPro Exploits Repository and the CISA CSAF Advisory.

Workarounds

Implement strict input validation and output encoding at the application layer if immediate patching is not possible
Deploy a web application firewall (WAF) with XSS detection rules in front of the CSWeb application
Restrict access to the CSWeb application to trusted users and networks while awaiting patch deployment
Enable strong Content Security Policy headers to mitigate XSS impact by preventing inline script execution

bash

# Example CSP header configuration for Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none'"