b1tm4r/cve-2025-29018Proof-of-concept for a stored XSS vulnerability in Code Astro Internet Banking System 2.0.0, demonstrating exploitation via the name parameter in pages_add_acc_type.php.
A Stored Cross-Site Scripting (XSS) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to unsanitized input in the name parameter in pages_add_acc_type.php. Attackers can store malicious JavaScript that executes whenever the page is loaded.
name parameter in pages_add_acc_type.php
(name parameter) field and submit the form: b1tm4rxss<script>alert("b1tm4r XSS");</script>
Impact
Mitigation
References