tansique-17/cve-2025-61456Public disclosure and proof-of-concept for a reflected XSS vulnerability (CVE-2025-61456) in an e-commerce project, including technical details, CVSS score, and remediation guidance.
Disclosure Date: 14 October 2025
CVE ID: CVE-2025-61456
Severity: MEDIUM (CVSS 6.1)
A reflected Cross-Site Scripting (XSS) vulnerability exists in the E-commerce Project v1.0, specifically within the index.php endpoint. Unsanitized input in the URL path parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who visits a malicious link or submits a crafted request.
This issue has been assigned the identifier CVE-2025-61456. At the time of disclosure, no patch has been released by the vendor.
index.phphttp://localhost/e-commerce-main/index.phpThe server fails to properly sanitize the URL path parameter in index.php before reflecting it into the response HTML. This allows attackers to inject JavaScript payloads through the URL path, leading to client-side code execution.
An attacker crafts input containing embedded script-like content and sends it to the vulnerable GET endpoint. Because the server reflects the input into the HTML response without applying proper HTML/attribute/JS encoding, the browser treats the reflected content as executable markup and runs it. This is a reflected (non-persistent) XSS scenario; the attacker must persuade a victim to perform the request or visit a specially constructed link/form.
$path = $_SERVER['PATH_INFO'];
echo "<div>Path: $path</div>";
| CWE ID | Title |
|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
| Score | Severity | Vector String |
|---|---|---|
| 6.1 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
A successful exploitation could result in:
git clone https://github.com/Bhabishya-123/E-commerce.git
Use XAMPP/LAMP to deploy the project and access the application.
GET /e-commerce-main/index.php/fmfct"><script>alert(1)</script>xfniu?id=unknown HTTP/1.1
Host: localhost
fmfct"><script>alert(1)</script>xfniu
Explanation:
The payload "><script>alert(1)</script> breaks out of the HTML context and injects a JavaScript alert. When a victim clicks a malicious link containing this payload, the JavaScript executes in their browser.
If vulnerable, the browser will execute the JavaScript code, displaying an alert box with the value 1.
htmlspecialchars() or equivalent to encode all untrusted output before rendering to HTML.$path = htmlspecialchars($_SERVER['PATH_INFO'], ENT_QUOTES, 'UTF-8');
echo "<div>Path: $path</div>";
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'
| Event | Date |
|---|---|
| Vulnerability Discovered | 16 September 2025 |
| Public Disclosure | 13 October 2025 |
| Patch Available | ❌ Not available as of disclosure |
This vulnerability was discovered and disclosed by:
Tansique Dasari
🔗 GitHub
✉️ [email protected]
💬 This advisory is published independently due to absence of an official vendor patch.