PT-2025-39066 · Unknown · Magicproject Ai

Published 2025-09-22 · Updated 2025-10-11 · CVE-2025-57203

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MagicProject AI version 9.1

Description MagicProject AI version 9.1 is affected by a Cross-Site Scripting (XSS) issue within the chatbot generation feature accessible to authenticated admin users. The issue is located in the prompt parameter submitted to the /dashboard/user/generator/generate-stream API endpoint via a multipart/form-data POST request. Insufficient input sanitization allows attackers to inject HTML-based JavaScript payloads. These payloads are stored and rendered without proper sanitization in subsequent views, resulting in execution within other users' browsers when they access the affected content. This allows an authenticated attacker to execute arbitrary JavaScript in the context of another user, potentially leading to session hijacking, privilege escalation, data exfiltration, or administrative account takeover. The application lacks a Content Security Policy (CSP) and adequate input filtering.

Recommendations Apply proper sanitization and output encoding to the prompt parameter. Implement strong Content Security Policy (CSP) enforcement.

Fix

LPE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-57203

Affected Products

Magicproject Ai

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-57203 · Security Note
• https://osv.dev/vulnerability/CVE-2025-57203 · Vendor Advisory
• https://t.me/CVEtracker/33085 · Telegram Post
• https://t.me/cveNotify/137344 · Telegram Post
• https://twitter.com/MeterPeter4Eva/status/1977066597430050938 · Twitter Post
• https://codecanyon.net/item/magicai-openai-content-text-image-chat-code-generator-as-saas/45408109 · Note
• https://twitter.com/CVEnew/status/1970765372249792513 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1970301272789037369 · Twitter Post