// For flags

CVE-2025-25189

[XBOW-025-031] Reflected Cross-Site Scripting via jobid Parameter in ZOO-Project WPS publish.py CGI Script

Severity Score

5.5
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

The ZOO-Project is an open source processing platform. A reflected Cross-Site Scripting vulnerability exists in the ZOO-Project Web Processing Service (WPS) publish.py CGI script prior to commit 7a5ae1a. The script reflects user input from the `jobid` parameter in its HTTP response without proper HTML encoding or sanitization. When a victim visits a specially crafted URL pointing to this endpoint, arbitrary JavaScript code can be executed in their browser context. The vulnerability occurs because the CGI script directly outputs the query string parameters into the HTML response without escaping HTML special characters. An attacker can inject malicious JavaScript code through the `jobid` parameter which will be executed when rendered by the victim's browser. Commit 7a5ae1a contains a fix for the issue.

ZOO-Project es una plataforma de procesamiento de código abierto. Existe una vulnerabilidad de tipo Cross-Site Scripting reflejado en el script CGI publish.py del Servicio de procesamiento web (WPS) de ZOO-Project antes de el commit 7a5ae1a. El script refleja la entrada del usuario desde el parámetro `jobid` en su respuesta HTTP sin la codificación HTML ni la depuración adecuadas. Cuando una víctima visita una URL especialmente manipulada que apunta a este endpoint, se puede ejecutar código JavaScript arbitrario en el contexto de su navegador. La vulnerabilidad se produce porque el script CGI genera directamente los parámetros de la cadena de consulta en la respuesta HTML sin escapar los caracteres especiales HTML. Un atacante puede inyectar código JavaScript malicioso a través del parámetro `jobid` que se ejecutará cuando lo procese el navegador de la víctima. El commit 7a5ae1a contiene una solución para el problema.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
System
Vulnerable | Subsequent
Confidentiality
None
Low
Integrity
None
Low
Availability
None
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
Poc
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2025-02-03 CVE Reserved
  • 2025-02-10 CVE Published
  • 2025-02-11 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
ZOO-Project
Search vendor "ZOO-Project"
 ZOO-Project
Search vendor "ZOO-Project" for product "ZOO-Project"
 < 7
Search vendor "ZOO-Project" for product "ZOO-Project" and version " < 7"
en
Affected