CVE-2025-10075 in Online Polling System
Summary
by MITRE • 09/08/2025
A security flaw has been discovered in SourceCodester Online Polling System 1.0. The impacted element is an unknown function of the file /manage-profile.php. The manipulation of the argument firstname results in cross site scripting. The attack can be launched remotely. The exploit has been released to the public and may be exploited.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/09/2025
The vulnerability identified as CVE-2025-10075 represents a critical cross site scripting flaw within the SourceCodester Online Polling System version 1.0. This security weakness specifically resides in the /manage-profile.php file where an unknown function processes user input without adequate sanitization measures. The vulnerability manifests when an attacker manipulates the firstname parameter, which is subsequently reflected in the application's output without proper encoding or validation. This type of vulnerability falls under the CWE-79 category of Cross Site Scripting, which is one of the most prevalent and dangerous web application security flaws. The attack vector is remotely exploitable, meaning that malicious actors can trigger this vulnerability through web browsers without requiring physical access to the target system. The public availability of exploit code significantly increases the risk profile of this vulnerability, as it removes the barrier to entry for potential attackers who may not possess advanced technical skills.
The operational impact of this vulnerability extends beyond simple data theft or defacement, as it provides attackers with the capability to execute arbitrary JavaScript code within the context of authenticated user sessions. When a victim visits a malicious page that triggers the XSS payload, the attacker can potentially hijack user sessions, steal sensitive information, or redirect users to malicious websites. The vulnerability affects the application's integrity and confidentiality properties, as it allows unauthorized code execution and data exfiltration. The fact that the exploit has been released to the public means that this vulnerability is likely being actively exploited in the wild, making immediate remediation essential for organizations using this software. This scenario aligns with ATT&CK technique T1566.001 which covers phishing with malicious attachments or links, as the XSS vulnerability could be leveraged to deliver additional payloads or redirect users to malicious sites.
Mitigation strategies for CVE-2025-10075 should prioritize immediate patching of the SourceCodester Online Polling System to the latest available version that addresses this specific vulnerability. Organizations should implement proper input validation and output encoding mechanisms to prevent XSS attacks by sanitizing all user-supplied data before it is processed or displayed. The application should employ Content Security Policy headers to limit the sources from which scripts can be executed and implement proper HTTPOnly flags for session cookies to prevent client-side script access to sensitive information. Additionally, regular security assessments and penetration testing should be conducted to identify similar vulnerabilities in other components of the web application infrastructure. The implementation of web application firewalls and security monitoring systems can provide additional layers of defense against exploitation attempts. Organizations should also consider implementing automated vulnerability scanning tools to continuously monitor for similar XSS vulnerabilities across their entire web application portfolio, as this type of flaw often indicates broader security issues within the application architecture that may require comprehensive remediation efforts.