CVE-2025-9211: Otalio Ship PMS XSS Privilege Escalation

CVE-2025-9211 Overview

CVE-2025-9211 is a stored cross-site scripting (XSS) vulnerability in Otalio Ship Property Management System versions before 2.22.0. The application security page fails to escape stored values, allowing authenticated attackers to inject persistent JavaScript payloads. When another user renders the affected page, the injected script executes in their browser context. Attackers use this behavior to escalate privileges by hijacking sessions of higher-privileged users. The flaw is tracked under CWE-79 and disclosed through the Mandiant Vulnerability Disclosures repository.

Critical Impact
Authenticated attackers can achieve privilege escalation and session takeover by planting persistent JavaScript in the application security page of the Otalio Ship Property Management System.

Affected Products

Otalio Ship Property Management System versions before 2.22.0
Deployments exposing the application security configuration page to non-administrative authenticated users
Environments where privileged users routinely browse the affected application security page

Discovery Timeline

2026-08-18 - CVE-2025-9211 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2025-9211

Vulnerability Analysis

The vulnerability is a stored (persistent) XSS flaw in the application security page of the Otalio Ship Property Management System. Input submitted to configuration fields is written to the backing store without output encoding. When the page is later rendered, the raw value is emitted directly into the HTML response.

Any script placed by the attacker executes with the privileges of the viewing user. Because the affected surface is the application security page, that viewing user is typically an administrator. This turns a lower-privileged authenticated foothold into an administrative session, matching the high confidentiality and integrity impact described in the advisory.

Root Cause

The root cause is missing output escaping on stored values rendered by the application security page. The application treats persisted configuration strings as trusted and injects them into the DOM without HTML entity encoding or context-aware escaping. This is a classic CWE-79 failure where sanitization is neither enforced on input nor on output.

Attack Vector

Exploitation requires an authenticated session with permissions to write to fields rendered by the application security page. The attacker submits a payload containing JavaScript, such as an <script> block or an event handler on a permitted tag. The payload persists until an administrator or other privileged user loads the page. On render, the script executes and can issue authenticated requests, read tokens from the DOM, or create new privileged accounts on behalf of the victim. See the Mandiant advisory MNDT-2026-0024 for disclosure details.

// No public proof-of-concept code is available.
// See the Mandiant disclosure referenced above for technical details.

Detection Methods for CVE-2025-9211

Indicators of Compromise

Stored configuration values in the application security page containing <script>, onerror=, onload=, or javascript: substrings
Unexpected creation, role changes, or permission grants for user accounts following administrator page views
Outbound requests from administrator browsers to attacker-controlled domains shortly after loading the security configuration page

Detection Strategies

Review application audit logs for edits to security page fields made by non-administrative accounts
Inspect the database for stored values containing HTML tags or JavaScript keywords in fields intended to hold plain text
Deploy a Content Security Policy (CSP) report-only header and alert on violations triggered by inline scripts on the security page

Monitoring Recommendations

Monitor browser-side telemetry from administrator workstations for anomalous script execution on Otalio application URLs
Alert on administrative role assignments that follow a security page view by the same session
Track authenticated write requests to the affected page and correlate with subsequent privileged actions

How to Mitigate CVE-2025-9211

Immediate Actions Required

Upgrade Otalio Ship Property Management System to version 2.22.0 or later
Restrict write access to the application security page to a minimal set of trusted administrators
Audit existing stored values on the affected page and remove any content containing HTML or script syntax

Patch Information

Otalio addressed the issue in Ship Property Management System version 2.22.0. Operators running any earlier release should plan an upgrade. Refer to the Mandiant Vulnerability Disclosure MNDT-2026-0024 and the Otalio solutions page for vendor guidance and release information.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources on the application
Place the application behind a web application firewall (WAF) with rules that block XSS payloads in requests to the security configuration endpoints
Reduce the number of accounts authorized to modify security page fields until the patch is applied

bash

# Example CSP header to block inline script execution until patched
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'