CVE-2025-62295: SOPlanning Stored XSS Vulnerability

CVE-2025-62295 Overview

CVE-2025-62295 is a stored cross-site scripting (XSS) vulnerability in SOPlanning, an open-source online planning tool. The flaw resides in the /groupe_form endpoint, where user-supplied input is stored without proper output encoding. An authenticated attacker with medium-level privileges can inject arbitrary HTML and JavaScript that executes when another user opens the group editor. The vulnerability affects SOPlanning versions prior to 1.55 and is tracked under [CWE-79]. Exploitation requires user interaction from the victim, typically an administrator loading the affected form.

Critical Impact
Attackers with medium privileges can execute arbitrary JavaScript in the browser of any user who opens the affected editor, enabling session theft, privilege escalation, and account takeover.

Affected Products

SOPlanning versions prior to 1.55
Web-based deployments exposing the /groupe_form endpoint
Multi-user planning instances with delegated group management

Discovery Timeline

2025-11-20 - CVE-2025-62295 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62295

Vulnerability Analysis

SOPlanning is a PHP-based collaborative planning application used to schedule projects, tasks, and resources. The /groupe_form endpoint handles group creation and editing functionality. The application accepts input for group attributes and stores that input in the backend database without sufficient sanitization or contextual output encoding.

When a user later opens the group editor, the stored input is rendered directly into the HTML response. Any HTML tags or JavaScript embedded in the stored fields execute in the victim's browser under the origin of the SOPlanning instance. Because the payload persists server-side, every subsequent visit to the editor triggers execution until an administrator removes the malicious record.

Root Cause

The root cause is missing output encoding on user-controlled data rendered within the group form template. The application trusts previously stored values and echoes them back into HTML contexts without applying htmlspecialchars or an equivalent escaping routine. This is a textbook Cross-Site Scripting (XSS) flaw classified under [CWE-79], improper neutralization of input during web page generation.

Attack Vector

Exploitation is network-based and requires an authenticated account with permissions to submit or modify group records via /groupe_form. The attacker submits a group entry containing a JavaScript payload embedded in an HTML attribute or tag. When a higher-privileged user, such as an administrator, opens the group editor, the browser parses and executes the stored script. The attacker can then harvest session cookies, perform actions on behalf of the victim, or pivot to broader compromise of the SOPlanning tenant.

No verified public proof-of-concept code is available. Refer to the CERT Poland advisory for coordinated disclosure details covering the SOPlanning vulnerability cluster.

Detection Methods for CVE-2025-62295

Indicators of Compromise

Group records in the SOPlanning database containing HTML tags such as <script>, <img onerror=>, or <svg onload=> in name or description fields.
Web server access logs showing POST requests to /groupe_form with payloads containing angle brackets or URL-encoded script fragments.
Unexpected outbound requests from administrator browsers to attacker-controlled domains after opening the group editor.

Detection Strategies

Query the SOPlanning database for group fields matching regular expressions that detect HTML or JavaScript syntax.
Deploy a web application firewall (WAF) rule that inspects form submissions to /groupe_form for XSS patterns.
Correlate authenticated form submissions with subsequent anomalous session activity, such as unusual API calls originating from admin sessions.

Monitoring Recommendations

Enable verbose HTTP logging on the SOPlanning reverse proxy or web server to capture full request bodies for the /groupe_form endpoint.
Alert on new or modified group records created by non-administrator accounts.
Monitor browser console errors and Content Security Policy (CSP) violation reports from administrator workstations accessing SOPlanning.

How to Mitigate CVE-2025-62295

Immediate Actions Required

Upgrade SOPlanning to version 1.55 or later, which contains the vendor fix for this issue.
Audit existing group records for stored HTML or JavaScript payloads and sanitize or remove malicious entries.
Restrict access to /groupe_form to trusted user roles until patching is complete.
Force session invalidation for administrator accounts that may have loaded compromised group data.

Patch Information

The issue was fixed in SOPlanning version 1.55. Administrators should download the latest release from the SOPlanning project site and follow the standard upgrade procedure. Verify the installed version after upgrade and re-audit group records to confirm no residual malicious content remains.

Workarounds

Apply a Content Security Policy (CSP) header restricting inline script execution and limiting script sources to trusted origins.
Reduce the number of accounts with group management privileges to lower the attack surface.
Place SOPlanning behind a WAF configured with OWASP Core Rule Set signatures targeting stored XSS payloads.

bash

# Example nginx Content Security Policy header for SOPlanning
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;