CVE-2025-0424

Vulnerability

CVE-2025-0424 is an authenticated stored cross-site scripting (XSS) vulnerability in the Cordaware bestinformed Web interface. The application fails to properly sanitize user input, allowing an authenticated attacker to inject malicious JavaScript code that is stored and later executed in the context of other users' sessions [1].

Exploitation

To exploit, the attacker must be authenticated. They inject the payload into a stored field (e.g., a comment or profile field) that is displayed to other users. When a victim views the content, the script executes. Because the attacker may have lower privileges than the victim, this enables horizontal privilege escalation within the application.

Impact

Successful exploitation compromises the sessions of other users, potentially leading to unauthorized access to sensitive data, privilege escalation, and further malicious actions under the victims' identities. The attacker can steal session cookies or perform actions on behalf of higher-privileged users.

Mitigation

The vendor has addressed the vulnerability in bestinformed Web interface version 6.2.2.5, as detailed in their changelog [1]. Users are advised to update to this version or later to remediate the issue.