projectworlds Expense Management System CVE-2025-12230

Exploitation requires the attacker to possess high-privilege administrative credentials or account access to projectworlds Expense Management System version 1.0. The attacker must have direct access to the /public/admin/currencies/create endpoint, which is restricted to authenticated administrative users. Additionally, user interaction is required - a second user must visit or interact with the page containing the injected payload for the XSS to execute. The vulnerability does NOT affect unauthenticated users or low-privilege accounts. Non-default or special configuration is not required; the vulnerability exists in the default installation's administrative currency creation feature.

This vulnerability presents low real-world risk despite public exploit availability. The EPSS score of 0.03% (9th percentile) indicates minimal probability of exploitation in the wild, reflecting the significant privilege and interaction barriers. The CVSS score of 1.9 is extremely low, primarily because PR:H (high privilege requirement) and UI:P (user interaction required) substantially reduce exploitability against most deployments. While the confidentiality, integrity, and availability impacts are minimal (VC:N/VI:L/VA:N), the required administrative access means only internal threats or compromised admin accounts pose practical risk. The public exploit exists (E:P) but no CISA KEV listing indicates no confirmed active exploitation campaign. This is a classic high-privilege XSS where the attacker profile (admin) and interaction requirement significantly limit practical attack surface compared to network-unauthenticated vulnerabilities. Organizations with robust access controls and session monitoring should deprioritize this relative to unauthenticated remote code execution flaws.

An authenticated administrative user with high-level privileges navigates to the Currency Page creation form (/public/admin/currencies/create) and injects a malicious JavaScript payload into a currency field without proper sanitization. When another user (typically another admin) visits the currency management page to view or edit existing currencies, the stored payload executes in their browser context, potentially stealing session cookies, performing actions on their behalf, or redirecting them to a phishing site. Public exploit code exists on GitHub demonstrating the injection technique.