CVE-2025-4512

Vulnerability

Overview

The Inetum IODAS application versions 7.2-LTS.4.1-JDK7 and 7.2-RC3.2-JDK7 contain a reflected cross-site scripting (XSS) vulnerability in the file /astre/iodasweb/app.jsp. An unknown function within this file fails to properly validate and encode user-supplied input when processing the action parameter. This allows an attacker to inject arbitrary JavaScript code that is immediately reflected back in the application's HTTP response [1].

Exploitation

Method

An attacker can exploit this vulnerability by crafting a malicious URL that includes a payload in the action parameter, such as ``. Since the attack is remote and does not require authentication, the attacker only needs to trick a victim into clicking the crafted link. The injected script then executes in the victim's browser within the context of the IODAS web application [1].

Impact and

Consequences

Successful exploitation enables a range of malicious activities, including performing actions on behalf of authenticated users, stealing session tokens, defacing the application's interface, redirecting victims to malicious sites, or conducting phishing attacks. These outcomes can lead to unauthorized access to user accounts and overall data compromise [1]. The vendor, Inetum, was contacted but did not respond, leaving no official patch or acknowledgement available as of publication [CVE description].

Mitigation

Status

No patch or vendor advisory has been released. Users are advised to implement mitigations such as sanitizing all user input, applying proper output encoding, deploying a Content Security Policy (CSP), and setting HttpOnly and Secure flags on cookies. Reviewing Web Application Firewall (WAF) settings is also recommended [1].