projectworlds Gate Pass Management System CVE-2025-12227

CRITICAL PREREQUISITES: (1) Attacker must have valid authenticated credentials to access the Gate Pass Management System (PR:L); (2) The /add-pass.php endpoint must be accessible and functional in the target deployment (non-disabled); (3) Input validation and output encoding must be absent or bypassable in the add-pass.php file; (4) A victim user must view or interact with the injected pass record (UI:P); (5) Victims must use a modern browser without strict CSP headers configured by the application. LIMITING FACTORS: Unauthenticated attackers cannot exploit this vulnerability directly - valid login credentials are required. The attack does not succeed passively; victim interaction (viewing the malicious content) is mandatory. Deployments with custom input filtering, output encoding middleware, or WAF rules blocking XSS patterns would be protected. The vulnerability is confined to reflected or stored XSS within the application context and cannot escape the browser sandbox without additional vulnerabilities.

This vulnerability presents a LOW real-world risk despite public exploit availability. Multiple signals confirm this assessment: CVSS v4.0 score of 2.0 reflects constrained scope (authenticated + user interaction required), EPSS at 0.03% percentile indicates minimal exploitation probability in the wild, and the lack of KEV (CISA Known Exploited Vulnerabilities) listing despite public POC suggests minimal active targeting. The impact is confined to integrity (VI:L - low information disclosure or session hijacking). Attack complexity is low (AC:L) and no special technical requirements (AT:N), but the requirement for authenticated access (PR:L) and user interaction (UI:P) dramatically reduces real-world exploitability in typical attack scenarios. This is a classic case where raw CVSS score is misleading; the contextual factors (authentication, interaction, low impact) make it a lower priority than higher-CVSS network-accessible RCE vulnerabilities. However, it remains a valid finding in authenticated application security assessments, particularly in environments where users have limited trust in each other or where the application handles sensitive data.

An authenticated user with access to the Gate Pass Management System crafts a malicious pass entry by injecting JavaScript payload (e.g., '<img src=x onerror=alert(document.cookie)>') into the add-pass.php form field. When an administrator or another user views the created pass record in the system, the injected script executes in their browser, potentially stealing session cookies, redirecting them to a phishing page, or performing actions on their behalf within the application.