CVE-2025-6340: Fabian School Fees Payment System XSS Flaw

CVE-2025-6340 Overview

CVE-2025-6340 is a stored cross-site scripting (XSS) vulnerability in code-projects School Fees Payment System 1.0. The flaw resides in the /branch.php endpoint, where the Branch, Address, and Detail parameters are not properly sanitized before being reflected or stored. An authenticated remote attacker can inject arbitrary JavaScript that executes in the browser context of any user viewing the affected page. The exploit has been publicly disclosed, increasing the risk of opportunistic abuse against exposed instances. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can inject persistent JavaScript through the branch management form, enabling session hijacking, credential theft, and unauthorized actions against administrators of the School Fees Payment System.

Affected Products

Fabian School Fees Payment System 1.0
CPE: cpe:2.3:a:fabian:school_fees_payment_system:1.0:*:*:*:*:*:*:*
Vulnerable component: /branch.php (parameters: Branch, Address, Detail)

Discovery Timeline

2025-06-20 - CVE-2025-6340 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6340

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the branch management module of the School Fees Payment System. The /branch.php script accepts user-supplied input via the Branch, Address, and Detail parameters. These values are written to the database and later rendered in the application's user interface without HTML entity encoding or contextual output escaping.

An attacker with low-privilege access can submit a crafted payload containing <script> tags or event-handler attributes. When an administrator or other user loads the branch listing page, the payload executes in their browser session. The attack requires user interaction to trigger, since a victim must view the poisoned record.

Successful exploitation grants the attacker execution of arbitrary JavaScript within the victim's authenticated session. This enables theft of session cookies, unauthorized form submissions on behalf of the victim, defacement of the interface, and pivoting to other authenticated actions within the application.

Root Cause

The root cause is missing input validation and output encoding on the Branch, Address, and Detail fields handled by /branch.php. The application concatenates untrusted input directly into HTML output, violating the neutralization requirements described in CWE-79.

Attack Vector

The attack is network-reachable and requires low privileges plus victim interaction. An authenticated attacker submits a branch record containing an XSS payload in any of the three vulnerable fields. When a subsequent user opens the branch view, the browser parses and executes the injected script under the application's origin.

Because no verified public proof-of-concept code has been indexed alongside this record, refer to the GitHub CVE Issue Discussion for reproduction details published by the reporter.

Detection Methods for CVE-2025-6340

Indicators of Compromise

HTTP POST requests to /branch.php containing angle brackets, javascript: URIs, or common XSS strings such as <script>, onerror=, or onload= in the Branch, Address, or Detail parameters.
Database rows in the branch table where these fields contain HTML markup, encoded script tags, or references to external attacker-controlled domains.
Unexpected outbound requests from administrator browsers to unknown hosts shortly after loading branch management pages.

Detection Strategies

Deploy a web application firewall (WAF) rule set that inspects /branch.php POST bodies for XSS signatures and blocks known payload patterns.
Audit stored records in the branch table for HTML or JavaScript content that should not appear in operational data.
Correlate authenticated administrator sessions with anomalous DOM-based activity or unexpected cookie exfiltration attempts observed in browser telemetry.

Monitoring Recommendations

Enable verbose access logging for /branch.php and centralize logs for search on injection-related tokens.
Monitor Content Security Policy (CSP) violation reports if a CSP is deployed, as script-src violations indicate blocked injection attempts.
Alert on repeated failed input validation events or requests originating from low-privilege accounts submitting HTML-formatted payloads.

How to Mitigate CVE-2025-6340

Immediate Actions Required

Restrict network access to the School Fees Payment System to trusted administrative networks until a patch is available.
Review all existing entries in the branch management table and purge records containing HTML or scripting content.
Rotate session tokens and administrator credentials if evidence suggests the vulnerable page was exposed to untrusted users.

Patch Information

At the time of publication, no vendor patch is listed in the vendor advisory references for Fabian School Fees Payment System 1.0. Track updates through the Code Projects Resource Hub and the VulDB entry #313335 for remediation status.

Workarounds

Implement a reverse-proxy WAF rule that rejects requests to /branch.php when parameter values contain <, >, or javascript: sequences.
Enforce a strict Content Security Policy that disallows inline scripts, mitigating execution of injected payloads.
Manually patch the affected code path to apply htmlspecialchars() with ENT_QUOTES on all output derived from Branch, Address, and Detail fields.
Limit the accounts permitted to create or edit branch records to a minimal set of trusted administrators.

bash

# Example nginx rule to block obvious XSS payloads on the vulnerable endpoint
location = /branch.php {
    if ($request_method = POST) {
        set $block 0;
        if ($request_body ~* "(<script|onerror=|onload=|javascript:)") { set $block 1; }
        if ($block = 1) { return 403; }
    }
    proxy_pass http://school_fees_backend;
}