projectworlds Advanced Library Management System CVE-2025-11425

Exploitation requires the following specific conditions: (1) The attacker must possess high-privilege administrative credentials to access /edit_admin.php and manipulate the firstname parameter - this is not a default-access vulnerability. (2) A victim user must interact with or visit a page displaying the injected firstname value, such as the admin profile page or admin list. (3) The target application must not implement output encoding on the firstname parameter when rendering in HTML. (4) No Content Security Policy restrictions blocking inline scripts must be in place. This is a stored/persistent XSS variant, so the malicious payload persists in the database and affects all subsequent viewers. Without high-privilege access, the vulnerability cannot be triggered; without user interaction viewing the compromised content, no code execution occurs.

This vulnerability presents minimal real-world risk despite CVE assignment. The CVSS 4.0 vector reveals critical limiting factors: PR:H (high privilege required) means only administrators can inject payloads, and UI:P (user interaction required) means victims must visit a malicious link or admin page for the script to execute. The EPSS score of 0.03% (9th percentile) indicates near-zero automated exploitation probability in the wild. While the CVSS integrity impact is rated low (VI:L) and the attack vector is network (AV:N), the combination of authentication + user interaction barriers makes this a low-priority issue. The existence of public POC code does not translate to widespread exploitation given these prerequisites. A more appropriate CVSS score would reflect AC:H (high complexity) or reduced impact, but the provided vector correctly captures the authentication and interaction requirements.

An administrator with high-level access to the Advanced Library Management System crafts a malicious firstname value containing JavaScript (e.g., firstname=<img src=x onerror=alert('XSS')>) and saves this through the /edit_admin.php endpoint. When another admin or user views the compromised admin profile, the JavaScript executes in their browser session, potentially stealing session cookies or performing actions on behalf of the victim. Public exploit code on GitHub demonstrates this payload injection technique.