PT-2025-6112 · Unknown · Zoo-Project
Xbow-Security
·
Published
2025-02-10
·
Updated
2025-02-12
·
CVE-2025-25189
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
Name of the Vulnerable Software and Affected Versions
ZOO-Project versions prior to commit 7a5ae1a
Description
The issue is related to a reflected Cross-Site Scripting vulnerability in the ZOO-Project Web Processing Service (WPS) publish.py CGI script. This vulnerability occurs because the script reflects user input from the
jobid parameter in its HTTP response without proper HTML encoding or sanitization, allowing an attacker to inject malicious JavaScript code. When a victim visits a specially crafted URL pointing to this endpoint, arbitrary JavaScript code can be executed in their browser context.Recommendations
As a temporary workaround, consider disabling the
jobid parameter in the publish.py CGI script until a patch is available.
Restrict access to the publish.py CGI script to minimize the risk of exploitation.
Avoid using the jobid parameter in the affected endpoint until the issue is resolved.
Update to a version that includes the fix provided in commit 7a5ae1a to resolve the issue.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Zoo-Project