CVE-2025-61549: Print Shop Pro WebDesk XSS Vulnerability

CVE-2025-61549 Overview

CVE-2025-61549 is a reflected Cross-Site Scripting (XSS) vulnerability in edu Business Solutions Print Shop Pro WebDesk version 18.34. The flaw resides in the LoginID parameter of the /PSP/app/web/reg/reg_display.asp endpoint. The application reflects unsanitized user input into HTTP responses without HTML encoding or escaping. Attackers can craft malicious URLs that execute arbitrary JavaScript in the victim's browser session. Successful exploitation requires user interaction such as clicking a crafted link. The vulnerability is classified under [CWE-79] and is fixed in version 19.76.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's authenticated session, enabling session hijacking, credential theft, and unauthorized actions within Print Shop Pro WebDesk.

Affected Products

edu Business Solutions Print Shop Pro WebDesk 18.34
Endpoint: /PSP/app/web/reg/reg_display.asp
Fixed version: Print Shop Pro WebDesk 19.76

Discovery Timeline

2026-01-08 - CVE-2025-61549 published to NVD
2026-02-10 - Last updated in NVD database

Technical Details for CVE-2025-61549

Vulnerability Analysis

The vulnerability is a reflected XSS flaw affecting the registration display page of Print Shop Pro WebDesk. The /PSP/app/web/reg/reg_display.asp endpoint accepts a LoginID query parameter and embeds its value into the rendered HTML response. The application does not apply HTML entity encoding, attribute escaping, or input sanitization before returning the content to the browser.

An attacker can craft a URL containing JavaScript payloads in the LoginID parameter. When a victim clicks the link, the browser parses the injected script as part of the trusted page and executes it under the application's origin. The attack vector is network-based and the attack complexity is low, but it requires user interaction.

Because the scope is changed, scripts executed under this vector can interact with content beyond the immediate vulnerable component, increasing the potential for session compromise and lateral abuse within the web application.

Root Cause

The root cause is improper neutralization of input during web page generation, as defined in [CWE-79]. User-controlled data from the LoginID parameter is concatenated into the HTML response without context-aware output encoding. The ASP page lacks both server-side input validation and client-safe output encoding for HTML, attribute, and JavaScript contexts.

Attack Vector

An attacker constructs a URL targeting the vulnerable endpoint with a JavaScript payload in the LoginID parameter. The attacker distributes the link through phishing email, chat, or a malicious page. When an authenticated Print Shop Pro WebDesk user follows the link, the injected script runs in the user's browser. The attacker can steal session cookies, exfiltrate form data, submit unauthorized print orders, or pivot to other application features available to the victim.

The vulnerability does not require authentication on the attacker side, but exploitation depends on the victim visiting the malicious URL while logged in. No verified public exploit code is currently available. For additional technical details, see the GitHub Vulnerability Disclosures.

Detection Methods for CVE-2025-61549

Indicators of Compromise

HTTP requests to /PSP/app/web/reg/reg_display.asp containing LoginID values with <script>, onerror=, onload=, javascript:, or encoded variants such as %3Cscript%3E.
Referer headers from external or untrusted domains pointing to the registration endpoint.
Outbound browser requests to attacker-controlled domains immediately after a user visits the registration page.

Detection Strategies

Inspect web server access logs and WAF telemetry for query strings on reg_display.asp containing HTML tags or JavaScript event handlers.
Deploy signatures in intrusion detection systems that flag reflected XSS payload patterns on the LoginID parameter.
Correlate authenticated session activity with anomalous client-side behavior such as unexpected outbound requests or DOM mutation events.

Monitoring Recommendations

Enable verbose logging on the IIS server hosting Print Shop Pro WebDesk and forward logs to centralized analytics.
Monitor for clusters of inbound requests with encoded script tags targeting the registration endpoint.
Alert on user accounts that authenticate from one IP while session cookies are reused from a different geolocation, indicating possible session theft.

How to Mitigate CVE-2025-61549

Immediate Actions Required

Upgrade Print Shop Pro WebDesk to version 19.76 or later, which contains the vendor fix for the LoginID reflection issue.
Audit web server logs for prior exploitation attempts targeting /PSP/app/web/reg/reg_display.asp.
Notify users of the application and reinforce caution when clicking links to the print shop portal from external sources.

Patch Information

The vendor addressed the vulnerability in Print Shop Pro WebDesk version 19.76. Operators running version 18.34 or earlier should plan an immediate upgrade. Refer to the GitHub Vulnerability Disclosures for additional disclosure details.

Workarounds

Deploy a web application firewall rule that blocks requests to reg_display.asp containing <, >, or JavaScript event handler tokens in the LoginID parameter.
Enforce a strict Content-Security-Policy header that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of script-based session theft.

bash

# Example WAF rule (ModSecurity) blocking script payloads on the LoginID parameter
SecRule REQUEST_URI "@contains /PSP/app/web/reg/reg_display.asp" \
    "chain,phase:2,deny,status:403,id:1006154901,msg:'Blocked XSS attempt on LoginID (CVE-2025-61549)'"
    SecRule ARGS:LoginID "@rx (?i)(<script|onerror=|onload=|javascript:|%3Cscript)" "t:none,t:urlDecodeUni"