Cyber Posture

CVE-2025-0530

LowPublic PoC

Published: 17 January 2025

Published
17 January 2025
Modified
03 March 2025
KEV Added
Patch
CVSS Score 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
EPSS Score 0.0014 34.3th percentile
Risk Priority 7 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse various implementations of JavaScript for execution.

Security Summary

CVE-2025-0530 is a cross-site scripting (XSS) vulnerability in code-projects Job Recruitment 1.0, affecting unknown code within the file /_parse/_feedback_system.php. The flaw stems from manipulation of the "type" argument, resulting in reflected XSS, and is classified as problematic with a CVSS v3.1 base score of 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N). It is associated with CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-94 (Improper Control of Generation of Code).

A remote attacker with low privileges can exploit this vulnerability by manipulating the "type" argument, though it requires user interaction to succeed. Exploitation enables limited integrity impact, such as injecting malicious scripts into web pages viewed by users, potentially leading to session hijacking or phishing in the context of the application's feedback system.

Advisories reference the project site at code-projects.org, a GitHub repository containing exploit details at github.com/ha0day125/cve/blob/main/xss-ha0day.md, and multiple VulDB entries (vuldb.com/?ctiid.292414, vuldb.com/?id.292414, vuldb.com/?submit.478674). The exploit has been publicly disclosed and may be used by attackers. No patches or specific mitigations are detailed in the available information.

Details

CWE(s)
CWE-79CWE-94

Affected Products

anisha
job recruitment
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

XSS vulnerability in public-facing web application enables exploitation for initial access (T1190) and malicious JavaScript execution (T1059.007) as mapped by VulDB.

References