CVE-2025-22917

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in Audemium ERP versions ≤0.9.0. The list.php script directly echoes the GET type parameter value into the page without proper sanitization or encoding, allowing an attacker to inject arbitrary HTML and JavaScript [1].

Exploitation

An attacker can craft a malicious URL containing a JavaScript payload in the type parameter (e.g., list.php?type=) and trick an authenticated user into visiting it. The injected script executes in the context of the user's session, inheriting any privileges the user holds within the ERP application [1].

Impact

Successful exploitation allows execution of arbitrary JavaScript in the victim's browser. An attacker could steal session cookies, perform actions on behalf of the user, deface pages, or redirect the user to malicious sites, potentially leading to account takeover or data exfiltration [1].

Mitigation

The vendor has been notified, and contributors recommend input sanitization and the addition of a Web Application Firewall (WAF) to mitigate the risk. Users should upgrade to a patched version if available or apply manual input validation on the type parameter [1].