CVE-2025-56697 in Computer Base Test
Summary
by MITRE • 09/16/2025
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the /users/adminpanel/admin/home.php?page=feedbacks file of Kashipara Computer Base Test v1.0. Attackers can inject malicious scripts via the smyFeedbacks POST parameter in /users/home.php.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2025
This stored cross-site scripting vulnerability exists within the Kashipara Computer Base Test v1.0 application where user feedback data is processed and stored in the database. The flaw specifically manifests in the admin panel's feedback handling mechanism at the path /users/adminpanel/admin/home.php?page=feedbacks, where the smyFeedbacks POST parameter is not properly sanitized or validated before being rendered back to users. When administrators or other users view feedback entries, the malicious script code injected through this parameter executes in their browsers, creating a persistent XSS attack vector that affects all users who access the compromised feedback data.
The technical implementation of this vulnerability stems from improper input validation and output encoding practices within the application's feedback processing module. The smyFeedbacks parameter received through POST requests lacks adequate sanitization measures, allowing attackers to inject HTML or JavaScript code that persists in the database. This stored nature means the malicious payload remains active even after the initial injection, making it particularly dangerous as it can affect multiple users over time. The vulnerability aligns with CWE-79 which defines improper neutralization of input during web page generation, and represents a classic case of stored XSS as outlined in the OWASP Top Ten 2021 category A03:2021.
The operational impact of this vulnerability is significant as it provides attackers with persistent access to user sessions and potential privilege escalation opportunities. An attacker could inject scripts that steal session cookies, redirect users to malicious sites, or even execute administrative commands if the feedback data is displayed with elevated privileges. The attack surface is particularly concerning given that feedback data is typically displayed in administrative panels where users may have elevated access rights. This vulnerability could enable attackers to gain unauthorized access to sensitive information, manipulate feedback data, or establish persistent backdoors within the application environment.
Mitigation strategies should focus on implementing comprehensive input validation and output encoding mechanisms throughout the application. All user-supplied data must be properly sanitized before storage, with special characters and script tags being neutralized or removed entirely. The application should employ context-specific output encoding when rendering feedback data, ensuring that any potentially malicious content is treated as plain text rather than executable code. Additionally, implementing proper access controls and privilege separation within the admin panel would limit the potential damage from successful exploitation. The principle of least privilege should be enforced, ensuring that feedback viewing capabilities do not automatically grant elevated administrative rights. Regular security testing including automated vulnerability scanning and manual penetration testing should be conducted to identify similar issues in other application components, aligning with NIST SP 800-53 security controls for input validation and output encoding.