CVE-2025-69606: GSVoIP Web Panel XSS Vulnerability

CVE-2025-69606 Overview

CVE-2025-69606 is a reflected Cross-Site Scripting (XSS) vulnerability in the GSVoIP web panel version 2.0.90. The flaw resides in the msg parameter of the /painel/gateways.php/error endpoint, which fails to sanitize user-supplied input before rendering it in the HTML response. A remote attacker can craft a malicious URL that, when clicked by an authenticated victim, executes arbitrary JavaScript in the browser context of the GSVoIP panel. Successful exploitation enables session hijacking, credential phishing, and other client-side attacks against VoIP administrators. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can hijack administrator sessions on the GSVoIP web panel and execute arbitrary JavaScript in the panel's origin, enabling takeover of VoIP gateway management.

Affected Products

GSVoIP web panel version 2.0.90
Solutions VoIP GSVoIP deployments exposing /painel/gateways.php/error
Any GSVoIP installation that renders the msg URL parameter without sanitization

Discovery Timeline

2026-05-01 - CVE-2025-69606 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2025-69606

Vulnerability Analysis

The GSVoIP web panel exposes an error display route at /painel/gateways.php/error that accepts a msg query parameter and reflects its value directly into the HTML response. Because the application does not HTML-encode or otherwise neutralize the input, attacker-controlled markup is rendered as part of the page DOM. An attacker can break out of an existing <script> context using a closing </script> tag and inject a new <script> block that executes in the panel's origin.

The published proof-of-concept demonstrates this with the payload </script><script>alert(document.domain)</script> supplied as the msg parameter. Because the attack requires user interaction—the victim must follow a crafted link—the impact is scoped to client-side execution, but the changed scope (S:C) reflects that script execution affects components beyond the vulnerable endpoint, including authenticated session cookies. See the GitHub PoC Repository for full reproduction steps.

Root Cause

The root cause is missing output encoding on the msg GET parameter inside gateways.php. User input is concatenated into HTML output without context-aware escaping, violating the standard contract for safe HTML rendering ([CWE-79]).

Attack Vector

Exploitation is remote and unauthenticated to deliver, but requires the victim to click a crafted link to a vulnerable GSVoIP instance. A representative malicious URL targets /painel/gateways.php/error?msg= with a URL-encoded </script><script>...</script> payload, as illustrated in the public PoC URL. When a logged-in administrator follows the link, the injected script runs with access to the panel's cookies, DOM, and authenticated API endpoints.

Detection Methods for CVE-2025-69606

Indicators of Compromise

Web server access logs containing requests to /painel/gateways.php/error with msg values that include <script, </script>, onerror=, javascript:, or URL-encoded equivalents such as %3Cscript%3E.
Referer headers pointing to external chat, email, or social platforms preceding requests to the error endpoint.
Unexpected administrator session activity, password changes, or gateway configuration edits originating from a single browser session shortly after a suspicious link click.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule to flag and block msg parameter values containing HTML tag delimiters or script keywords on the GSVoIP panel.
Enable browser-side telemetry by configuring a strict Content Security Policy (CSP) with report-uri to capture inline-script violations on /painel/gateways.php/*.
Hunt historical web logs for the exact PoC pattern msg=%3C%2Fscript%3E%3Cscript%3E and similar reflected XSS signatures.

Monitoring Recommendations

Forward GSVoIP web server access logs to a centralized analytics platform and alert on anomalous msg parameter content.
Monitor for outbound requests from administrator browsers to unfamiliar domains immediately after visiting /painel/gateways.php/error.
Track CSP violation reports to identify attempted script injection in production.

How to Mitigate CVE-2025-69606

Immediate Actions Required

Restrict access to the GSVoIP web panel to trusted management networks or VPN-only reachability until a vendor patch is applied.
Instruct administrators to avoid clicking GSVoIP links from untrusted sources and to log out of the panel when not actively in use.
Deploy a virtual patch via WAF that blocks requests to /painel/gateways.php/error containing HTML or script metacharacters in the msg parameter.

Patch Information

No vendor advisory or fixed version has been published in the NVD record at the time of writing. Operators should monitor the Solutions VoIP website for an official update and apply HTML output encoding on the msg parameter once available. Until then, treat all GSVoIP 2.0.90 deployments as vulnerable.

Workarounds

Add a reverse proxy or WAF rule that strips or rejects msg values containing <, >, ", ', or URL-encoded variants before they reach gateways.php.
Enforce a strict Content Security Policy that disallows inline scripts (script-src 'self') on the /painel/ path to neutralize injected payloads.
Set the HttpOnly and Secure flags on session cookies and enable SameSite=Strict to limit the impact of session theft via XSS.

bash

# Example NGINX rule to block reflected XSS payloads on the vulnerable endpoint
location ~* ^/painel/gateways\.php/error {
    if ($arg_msg ~* "(<|>|%3C|%3E|script|onerror=|javascript:)") {
        return 403;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;
    add_header X-XSS-Protection "1; mode=block" always;
    proxy_pass http://gsvoip_backend;
}