CVE-2025-71179: Academy LMS 7.0 Reflected XSS Vulnerability

CVE-2025-71179 Overview

CVE-2025-71179 is a reflected Cross-Site Scripting (XSS) vulnerability affecting Creativeitem Academy LMS version 7.0. The vulnerability exists in multiple endpoints where user-supplied input is not properly sanitized before being reflected back to users in the browser context. Attackers can exploit this flaw to execute arbitrary JavaScript code in victims' browsers by crafting malicious URLs containing XSS payloads.

The vulnerability specifically affects the search parameter at the /academy/blogs endpoint and the string parameter at the /academy/course_bundles/search/query endpoint. Importantly, these vulnerable parameters are distinct from those addressed in CVE-2023-4119, which only remediated XSS issues in the query and sort_by parameters at the /academy/home/courses endpoint.

Critical Impact

Attackers can steal session cookies, redirect users to malicious sites, deface content, or perform actions on behalf of authenticated users by exploiting these reflected XSS vulnerabilities in the Academy LMS platform.

Affected Products

• Creativeitem Academy LMS 7.0
• Academy Course Based Learning Management System (available via Codecanyon)

Discovery Timeline

• 2026-02-03 - CVE-2025-71179 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-71179

Vulnerability Analysis

This reflected XSS vulnerability occurs due to insufficient input validation and output encoding in the Academy LMS web application. When users submit search queries through the affected endpoints, the application reflects the user-supplied input directly into the HTML response without proper sanitization or encoding. This allows attackers to inject malicious JavaScript code that executes in the context of the victim's browser session.

The vulnerability requires user interaction, as victims must click on a specially crafted malicious link for the attack to succeed. Once executed, the injected script runs with the same privileges as the legitimate application, potentially allowing attackers to access sensitive data, modify page content, or perform unauthorized actions.

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which represents one of the most common and impactful web application security flaws.

Root Cause

The root cause stems from inadequate input sanitization in the search functionality of Academy LMS. The search parameter in the /academy/blogs endpoint and the string parameter in the /academy/course_bundles/search/query endpoint fail to properly validate, sanitize, or encode user-supplied data before rendering it in the HTML response. This allows script tags and other HTML elements to be interpreted by the browser rather than displayed as plain text.

Attack Vector

The attack vector is network-based, requiring an attacker to craft a malicious URL containing the XSS payload and deliver it to potential victims through phishing emails, social media, or other distribution methods. When a victim clicks the malicious link while authenticated to the Academy LMS platform, the injected script executes in their browser context.

The exploitation flow typically involves:

1. The attacker identifies the vulnerable parameter in the search functionality
2. A malicious URL is constructed with JavaScript payload embedded in the search or string parameter
3. The URL is delivered to victims through social engineering techniques
4. When the victim clicks the link, the Academy LMS application reflects the malicious input without sanitization
5. The victim's browser executes the injected JavaScript code, allowing the attacker to steal cookies, capture keystrokes, or perform other malicious actions

For detailed technical information about this vulnerability, refer to the GitHub security advisory and the Exploit-DB entry.

Detection Methods for CVE-2025-71179

Indicators of Compromise

• Unusual or encoded script tags in web server access logs for /academy/blogs or /academy/course_bundles/search/query endpoints
• HTTP requests containing suspicious payloads such as <script>, javascript:, onerror=, or other XSS attack patterns in the search or string parameters
• Unexpected JavaScript execution or browser console errors reported by users after clicking links to the Academy LMS platform
• Session hijacking attempts or unauthorized account access following user visits to suspicious URLs

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS payloads in query parameters
• Deploy endpoint detection and response (EDR) solutions like SentinelOne to identify malicious script execution in browser processes
• Configure Content Security Policy (CSP) headers to prevent inline script execution and report violations
• Enable detailed logging of all requests to the affected endpoints for forensic analysis

Monitoring Recommendations

• Monitor web server logs for requests to /academy/blogs and /academy/course_bundles/search/query containing suspicious characters or encoded payloads
• Implement real-time alerting for patterns matching known XSS attack signatures in URL parameters
• Review CSP violation reports to identify attempted XSS exploitation
• Track anomalous user session behavior that may indicate successful session hijacking

How to Mitigate CVE-2025-71179

Immediate Actions Required

• Apply vendor patches or updates for Creativeitem Academy LMS as soon as they become available
• Implement input validation to reject or sanitize dangerous characters in the search and string parameters
• Deploy a Web Application Firewall (WAF) with XSS protection rules as a temporary mitigation
• Enable Content Security Policy (CSP) headers to restrict script execution sources

Patch Information

Organizations using Creativeitem Academy LMS 7.0 should check for updates from the vendor. For the latest version and security updates, refer to the CreativeItem Academy LMS product page or the Codecanyon listing.

Workarounds

• Implement server-side input validation to strip or encode HTML special characters from the search and string parameters
• Deploy a reverse proxy or WAF (such as ModSecurity with OWASP Core Rule Set) to filter incoming requests containing XSS payloads
• Configure strict Content Security Policy headers with script-src 'self' to prevent execution of inline scripts
• Educate users about the risks of clicking unknown or suspicious links, particularly those containing URL-encoded content

# Example Apache ModSecurity configuration to block XSS attempts
SecRule ARGS "@detectXSS" "id:1001,phase:2,deny,status:403,msg:'XSS Attack Detected',log"
SecRule REQUEST_URI "@contains /academy/blogs" "id:1002,chain,phase:2,deny,status:403"
SecRule ARGS:search "@detectXSS" "msg:'XSS in search parameter'"