CVE-2025-63725: Radioinorr Svx Portal XSS Vulnerability

CVE-2025-63725 Overview

CVE-2025-63725 is a reflected Cross-Site Scripting (XSS) vulnerability in Radioinorr SVX Portal version 2.7A. The flaw exists in Recivers.php, where the id parameter is reflected into the response without proper output encoding. Attackers can craft a malicious URL that, when visited by an authenticated or unauthenticated user, executes arbitrary JavaScript in the victim's browser session. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation allows attackers to execute arbitrary script in a victim's browser, enabling session token theft, credential harvesting, and unauthorized actions within the SVX Portal application.

Affected Products

Radioinorr SVX Portal 2.7A
Component: Recivers.php
Vulnerable parameter: id

Discovery Timeline

2025-11-14 - CVE-2025-63725 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-63725

Vulnerability Analysis

The vulnerability resides in the Recivers.php script of SVX Portal 2.7A. The application accepts the id query parameter from user-supplied input and reflects its value directly into the HTML response. Because the value is rendered inside an attribute context without proper escaping or sanitization, an attacker can break out of the attribute and inject arbitrary HTML or JavaScript.

The attack requires user interaction — a target must click a crafted link — and the scope is changed because injected script runs within the origin of the SVX Portal application. This grants the attacker access to cookies, session storage, and the Document Object Model (DOM) of the affected page. Additional analysis of the flaw is available in the DeepStrike reflected XSS write-up.

Root Cause

The root cause is missing output encoding of the id parameter before it is written into an HTML attribute context. The application does not apply context-aware escaping (such as HTML attribute encoding) and does not validate the parameter against an expected data type or format.

Attack Vector

An attacker delivers a crafted URL containing a malicious payload in the id parameter through phishing, chat, or a link on a controlled site. When a victim visits the URL, the injected payload executes in the browser under the SVX Portal origin. No authentication is required to craft the URL, but the victim must interact with the link. A related SQL injection issue in the same product has also been documented, indicating broader input validation weaknesses.

Exploitation code is not reproduced here. The public technical references describe how the id parameter breaks out of an unescaped attribute context to trigger script execution.

Detection Methods for CVE-2025-63725

Indicators of Compromise

Web server access logs containing requests to Recivers.php with id parameter values that include characters such as <, >, ", ', or the strings script, onerror, onload, or javascript:.
Referer headers pointing to untrusted external domains preceding requests to Recivers.php.
Unusual outbound requests from user browsers to attacker-controlled domains following portal access.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the id query parameter for XSS payload signatures on any request path matching Recivers.php.
Enable server-side logging of full query strings for the SVX Portal application and alert on encoded payloads (for example, %3Cscript%3E, %22%3E).
Correlate suspicious inbound URLs with user session activity to identify post-exploitation actions such as unexpected password changes or data exports.

Monitoring Recommendations

Monitor browser Content Security Policy (CSP) violation reports if a CSP is deployed in report-only or enforcing mode.
Alert on repeated 200 OK responses to Recivers.php requests containing suspicious id values from a small set of source IPs.
Review authentication logs for session anomalies immediately following clicks on external inbound links to the portal.

How to Mitigate CVE-2025-63725

Immediate Actions Required

Restrict public access to Recivers.php where feasible, or place the SVX Portal behind an authenticated reverse proxy.
Deploy WAF signatures to block XSS payloads targeting the id parameter on the Recivers.php endpoint.
Notify portal users to avoid clicking untrusted links referencing the SVX Portal domain.

Patch Information

At the time of publication, no vendor advisory or official patch is listed for Radioinorr SVX Portal 2.7A. Administrators should monitor the vendor for updates and consult the DeepStrike reflected XSS advisory for further technical context. Until a fix is released, apply compensating controls such as WAF rules and strict input validation at any upstream proxy.

Workarounds

Implement a strict Content Security Policy that disallows inline scripts (script-src 'self') to reduce the impact of injected payloads.
Configure a WAF or reverse proxy to reject requests to Recivers.php whose id parameter contains HTML metacharacters or does not match an expected numeric pattern.
Set the HttpOnly and Secure flags on all session cookies to limit token theft via script access.

bash

# Example ModSecurity rule to block XSS payloads on the id parameter
SecRule REQUEST_FILENAME "@endsWith /Recivers.php" \
  "chain,phase:2,deny,status:403,id:1006372501,\
   msg:'CVE-2025-63725 Reflected XSS attempt on SVX Portal Recivers.php'"
SecRule ARGS:id "@rx (?i)(<script|onerror=|onload=|javascript:|%3Cscript)" \
  "t:none,t:urlDecodeUni,t:lowercase"