CVE-2025-64030: Eximbills Enterprise XSS Vulnerability

CVE-2025-64030 Overview

CVE-2025-64030 is an authenticated stored cross-site scripting (XSS) vulnerability [CWE-79] affecting Eximbills Enterprise 4.1.5 (built on 2020-10-30) from China Systems. The flaw resides in the /EximBillWeb/servlets/WSTrxManager endpoint, where the TMPL_INFO parameter accepts unsanitized user input. The application stores this input server-side and renders it back to other users without proper encoding. An authenticated attacker can inject arbitrary JavaScript that executes in the browsers of victim users who view the affected content.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in victim browsers, enabling session theft, credential harvesting, and unauthorized actions within the banking application context.

Affected Products

China Systems Eximbills Enterprise 4.1.5 (built 2020-10-30)
/EximBillWeb/servlets/WSTrxManager servlet endpoint
Deployments processing user input via the TMPL_INFO parameter

Discovery Timeline

2025-12-01 - CVE-2025-64030 published to NVD
2025-12-29 - Last updated in NVD database

Technical Details for CVE-2025-64030

Vulnerability Analysis

The vulnerability exists in the request handling logic of the WSTrxManager servlet within the EximBillWeb application. The servlet accepts the TMPL_INFO parameter from authenticated users and persists its contents server-side. When other authenticated users subsequently request views that include the stored value, the application emits the data into HTML responses without applying output encoding or contextual sanitization.

Because Eximbills Enterprise is a transaction processing platform used in banking workflows, executed JavaScript runs with the privileges of the victim's authenticated session. An attacker can read DOM-rendered transaction data, exfiltrate session cookies, or trigger requests that perform unauthorized actions on behalf of the victim. The user interaction requirement reflects that the victim must load the affected view for the payload to fire.

Root Cause

The root cause is missing input validation on write and missing output encoding on read. The TMPL_INFO parameter is treated as trusted content rather than untrusted user input. Neither server-side sanitization nor context-aware HTML encoding is applied before the value is rendered in the response body, allowing <script> tags and event handlers to execute.

Attack Vector

An attacker with valid low-privilege credentials submits a crafted request to /EximBillWeb/servlets/WSTrxManager containing a malicious JavaScript payload in the TMPL_INFO parameter. The payload persists in application storage. When a second authenticated user, such as an approver or supervisor, views the affected resource, the script executes in their browser within the application origin. The cross-scope impact reflects that compromised sessions may span different privilege boundaries.

For full technical detail, see the Medium write-up on Stored XSS in Eximbills Enterprise.

Detection Methods for CVE-2025-64030

Indicators of Compromise

HTTP POST requests to /EximBillWeb/servlets/WSTrxManager containing <script>, javascript:, or HTML event handler strings in the TMPL_INFO parameter.
Stored records in Eximbills application tables containing encoded or raw script tags within template metadata fields.
Unexpected outbound requests from user browsers to attacker-controlled domains following access to transaction templates.

Detection Strategies

Inspect web server and application logs for TMPL_INFO parameter values containing HTML or JavaScript syntax patterns such as %3Cscript, onerror=, or onload=.
Deploy web application firewall rules that flag XSS payload signatures targeting the WSTrxManager servlet path.
Perform content scans of stored template data for previously injected payloads that may already reside in the database.

Monitoring Recommendations

Enable verbose request logging on the EximBillWeb application server and forward logs to a centralized analytics platform.
Monitor browser-side telemetry for anomalous script execution and unexpected cookie or token transmission from Eximbills sessions.
Alert on authenticated user accounts that submit unusual character distributions or oversized values to template-related parameters.

How to Mitigate CVE-2025-64030

Immediate Actions Required

Contact China Systems support to obtain remediation guidance for Eximbills Enterprise 4.1.5 deployments.
Audit existing template records for stored script payloads and purge any malicious content before users access affected views.
Restrict access to the WSTrxManager servlet to only required roles and trusted network segments.

Patch Information

No vendor advisory or patch URL is currently published in the NVD record for CVE-2025-64030. Operators should engage China Systems directly to confirm fixed versions and request remediation. Refer to the China Systems Eximbills Enterprise product page for vendor contact information.

Workarounds

Deploy a web application firewall in front of Eximbills Enterprise with rules that block HTML and script syntax in the TMPL_INFO parameter.
Enforce a strict Content Security Policy (CSP) on the EximBillWeb application to limit inline script execution and external script sources.
Configure browser session controls such as HttpOnly and Secure cookie flags to limit the impact of any script execution that does occur.

bash

# Example ModSecurity rule to block script payloads in TMPL_INFO
SecRule ARGS:TMPL_INFO "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1000064030,phase:2,deny,status:403,\
    msg:'CVE-2025-64030 Eximbills Stored XSS attempt blocked',\
    tag:'CWE-79'"