CVE-2025-60948: Census CSWeb Stored XSS Vulnerability

CVE-2025-60948 Overview

Census CSWeb version 8.0.1 is affected by a stored cross-site scripting (XSS) vulnerability in user-supplied input fields. A remote, authenticated attacker can inject malicious JavaScript code that persists within the application and executes in the browser of any victim who views the affected content. This type of stored XSS vulnerability is particularly dangerous as the malicious payload persists server-side, potentially affecting multiple users over time.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in victim browsers, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of legitimate users.

Affected Products

• CSPro Users CSWeb version 8.0.1
• Census CSWeb 8 data collection and processing platform

Discovery Timeline

• 2026-03-23 - CVE-2025-60948 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2025-60948

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) exists in Census CSWeb 8.0.1 due to insufficient sanitization of user-supplied input fields. The application fails to properly encode or validate user input before storing it in the database and subsequently rendering it in web pages. When victims access pages containing the injected content, the malicious JavaScript executes within their browser context, inheriting their session privileges and access permissions.

The attack requires network access and an authenticated session on the CSWeb platform. User interaction is required as the victim must navigate to a page containing the stored malicious payload. While the confidentiality and integrity impacts are limited in scope to the affected user's browser session, the persistent nature of the attack means multiple users could be compromised over time.

Root Cause

The root cause of CVE-2025-60948 is improper input validation and output encoding in CSWeb's handling of user-supplied form fields. The application stores user input directly in the database without adequate sanitization and then renders this content in HTML responses without proper encoding, allowing injected JavaScript to execute as trusted code within the application's origin.

Attack Vector

An authenticated attacker exploits this vulnerability by injecting malicious JavaScript code into vulnerable user input fields within the CSWeb application. The attack follows a typical stored XSS pattern:

1. The attacker authenticates to the CSWeb application with valid credentials
2. The attacker submits malicious JavaScript payload through a vulnerable input field (such as user profile information, survey data, or other user-controlled content)
3. The application stores the unvalidated payload in its database
4. When another user or administrator views the page containing this stored content, the malicious script executes in their browser
5. The script can then perform actions such as stealing session cookies, capturing keystrokes, redirecting to phishing sites, or performing unauthorized operations

The vulnerability leverages network-based access with low attack complexity, though it requires prior authentication and victim interaction.

Detection Methods for CVE-2025-60948

Indicators of Compromise

• Unusual JavaScript patterns in stored database content or application logs, particularly <script> tags or event handlers in user-supplied fields
• Unexpected HTTP requests originating from user browsers to external domains
• Session token exfiltration attempts visible in network traffic analysis
• User reports of unexpected browser behavior when accessing CSWeb application pages

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block common XSS payload patterns in incoming requests
• Deploy content security policy (CSP) headers to restrict script execution sources and detect policy violations
• Monitor application logs for submissions containing HTML tags, JavaScript keywords, or URL-encoded script elements
• Conduct regular security scans of the CSWeb application to identify stored XSS payloads in the database

Monitoring Recommendations

• Enable detailed logging of all user input submissions to CSWeb form fields
• Configure browser-based CSP violation reporting to capture attempted XSS exploitation
• Monitor for anomalous session activity that may indicate session hijacking following XSS attacks
• Review database content periodically for suspicious patterns that may indicate stored malicious payloads

How to Mitigate CVE-2025-60948

Immediate Actions Required

• Upgrade CSWeb to version 8.1.0 alpha or later, which includes the security fix for this vulnerability
• Review stored data in affected CSWeb deployments for potentially malicious content injected prior to patching
• Implement Content Security Policy (CSP) headers to restrict inline script execution as a defense-in-depth measure
• Consider forcing session invalidation for all users after patching to mitigate any ongoing session compromise

Patch Information

The vendor has addressed this vulnerability in CSWeb version 8.1.0 alpha. The fix is available in the CSWeb GitHub commit eba0b59a. Organizations should upgrade to the patched version as soon as possible.

Additional technical references are available in the GitHub CSPro Exploits Repository and the CISA CSAF Advisory.

Workarounds

• Implement strict input validation and output encoding at the application layer if immediate patching is not possible
• Deploy a web application firewall (WAF) with XSS detection rules in front of the CSWeb application
• Restrict access to the CSWeb application to trusted users and networks while awaiting patch deployment
• Enable strong Content Security Policy headers to mitigate XSS impact by preventing inline script execution

# Example CSP header configuration for Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none'"