---

CVE-2025-29015 - Internet Banking System 2.0.0 Stored XSS in pages_account.php

Description

A Stored Cross-Site Scripting (XSS) vulnerability exists in Code Astro Internet Banking System 2.0.0 via the name parameter in /admin/pages_account.php. Malicious JavaScript code can be injected and stored in the system, executing whenever an admin views the affected page. This can lead to session hijacking and other client-side attacks.

Affected Component

• name parameter in /admin/pages_account.php
• Data is stored and executed when accessed by an admin

Exploitation Steps

1. Log in to the admin panel and navigate to the "Account" section.

3. Insert the following payload in the name field and submit the form:

   //--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(98, 49, 116, 109, 52, 114));</SCRIPT>

3. When the user visits any page or menu, the payload will trigger.

Impact

• Session Hijacking
• Phishing Attacks
• Arbitrary Actions on Behalf of an Admin

Mitigation

• Implement proper input sanitization (e.g., escaping special characters).
• Use Content Security Policy (CSP) to limit script execution.
• Validate and encode user input before storing it.

References

• OWASP XSS Guide