CVE-2025-40695 in Online Fire Reporting System
Summary
by MITRE • 09/11/2025
Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'remark', 'status' and 'takeaction' parameters via POST at the endpoint '/ofrs/admin/request-details.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/12/2025
The vulnerability CVE-2025-40695 represents a critical stored cross site scripting flaw in the Online Fire Reporting System version 1.2 developed by PHPGurukul. This security weakness exists within the administrative interface of the system where user inputs are not properly validated or sanitized before being stored and subsequently rendered in web pages. The vulnerability specifically affects the 'remark', 'status', and 'takeaction' parameters that are processed through the POST method at the '/ofrs/admin/request-details.php' endpoint. This stored XSS vulnerability allows an attacker to inject malicious scripts that persist in the application's database and execute whenever authenticated users view the affected content.
The technical implementation of this vulnerability stems from inadequate input validation and output encoding practices within the application's backend processing logic. When administrators or authorized users access the request details page, the stored malicious scripts contained in the 'remark', 'status', or 'takeaction' fields are executed within the browser context of the authenticated user. This flaw falls under CWE-79 which specifically addresses Cross-Site Scripting vulnerabilities, and more precisely aligns with CWE-80 which deals with the improper neutralization of script in different contexts. The vulnerability's classification as authenticated XSS indicates that the attack requires a legitimate user account, but once compromised, the attacker can leverage the authenticated session to perform unauthorized actions.
The operational impact of this vulnerability extends beyond simple script execution as it enables session hijacking through cookie theft mechanisms. An attacker who successfully injects malicious scripts can create persistent XSS payloads that capture authentication cookies, session tokens, or other sensitive information from the victim's browser. This capability allows for unauthorized access to administrative functions, data manipulation, and potential lateral movement within the system. The stored nature of the vulnerability means that the malicious payload remains active even after the initial injection, continuously targeting any user who accesses the affected pages. This characteristic makes the vulnerability particularly dangerous as it can affect multiple users over extended periods without requiring repeated exploitation attempts.
Mitigation strategies for this vulnerability should focus on implementing comprehensive input validation and output encoding mechanisms throughout the application's data processing pipeline. The most effective approach involves sanitizing all user inputs using context-specific encoding techniques before storing or rendering data in web pages. This includes implementing proper HTML entity encoding for output, utilizing Content Security Policy headers to limit script execution, and employing parameterized queries to prevent injection attacks. Security controls should also include regular input validation checks, session management improvements, and monitoring for suspicious activities within the administrative interface. Organizations should consider implementing the ATT&CK technique T1548.002 which involves using credentials to maintain access and T1071.001 which covers application layer protocol usage. Additionally, regular security audits and penetration testing should be conducted to identify similar vulnerabilities in the codebase, and the system should be updated to the latest version of the software where these issues have been addressed by the vendor.