CVE-2025-11682 in Customer Engagement & Loyalty Platform
Summary
by MITRE • 10/27/2025
Stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement & Loyalty Platform allows an authenticated attacker to execute arbitrary JavaScript code in a victim's browser. The vulnerability is due to improper sanitization of SVG file uploads. An attacker can upload a malicious SVG file containing a script payload to a campaign. When another user views this image on the public LMT microsite, the script executes, which can lead to session hijacking, data theft, or other unauthorized actions.This issue affects Customer Engagement & Loyalty Platform before 4.617.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/27/2025
The CVE-2025-11682 vulnerability represents a critical stored cross-site scripting flaw within the LMT Dashboard component of the Perx Customer Engagement & Loyalty Platform. This vulnerability specifically targets the platform's handling of SVG file uploads, creating a persistent security risk that can be exploited by authenticated attackers to compromise user sessions and execute unauthorized code. The vulnerability affects all versions of the platform prior to 4.617.4, making it a significant concern for organizations that have not yet updated their systems. The flaw resides in the insufficient sanitization of SVG file content, which allows malicious payloads to be embedded within otherwise legitimate image files that are subsequently rendered on public-facing microsites.
The technical implementation of this vulnerability stems from inadequate input validation and sanitization processes within the platform's SVG upload functionality. When an attacker uploads a malicious SVG file containing embedded JavaScript code, the system fails to properly sanitize or escape the content before storing it within the campaign data. This stored malicious content becomes executable when users access the public LMT microsite where the compromised SVG image is displayed. The vulnerability is classified as a stored XSS issue because the malicious script is permanently stored on the server and executed each time the affected page is loaded by a victim. This type of vulnerability is particularly dangerous because it can persist long after the initial upload and can affect multiple users without requiring them to interact with the malicious content directly.
The operational impact of this vulnerability extends beyond simple script execution, creating substantial risks for organizations using the Perx platform for customer engagement and loyalty programs. When attackers successfully exploit this vulnerability, they can hijack user sessions, steal sensitive customer data, and potentially gain access to additional system resources through the compromised user accounts. The attack vector is particularly concerning because it leverages legitimate platform functionality to deliver malicious payloads, making detection more difficult. Users who view compromised SVG images on the public microsite become unwitting participants in the attack, with their browsers executing the embedded JavaScript code without their knowledge. This vulnerability can lead to data breaches, customer information compromise, and potential regulatory violations for organizations that fail to address the issue promptly.
Organizations should prioritize immediate remediation of this vulnerability by upgrading to Perx Customer Engagement & Loyalty Platform version 4.617.4 or later, which contains the necessary patches to address the SVG sanitization issues. Security teams should implement additional monitoring of SVG upload activities and conduct thorough review of uploaded content to identify any potentially malicious files. The vulnerability aligns with CWE-79, which specifically addresses cross-site scripting flaws, and represents a clear violation of the principle of input validation and output encoding as recommended by the OWASP Top Ten. From an ATT&CK framework perspective, this vulnerability maps to T1566.001 (Phishing with Malicious Attachments) and T1059.007 (Command and Scripting Interpreter: JavaScript), demonstrating how an initial compromise can escalate into broader system exploitation. Organizations should also consider implementing Content Security Policy headers and additional network monitoring to detect and prevent exploitation attempts, while ensuring that all user uploads undergo strict validation before being made available to other users.