Simple Stock System CVE-2025-14962

The vulnerability requires user interaction (UI:P per CVSS vector) - specifically, a victim must click a malicious link or visit a page containing injected payload. No authentication is required to craft or deliver the payload (PR:N), meaning an unauthenticated remote attacker can generate XSS payloads targeting any Simple Stock System 1.0 instance. However, exploitation is limited to the context of the /market/chatuser.php endpoint; payloads injected through other application endpoints or fixed input fields may not execute. The flaw manifests only in response rendering - successful exploitation depends on the victim's browser interpreting the injected script, which modern browsers partially mitigate through built-in XSS filters (though these are not reliable). The chat function must be active and accessible in the deployed instance; if the /market/ endpoint is blocked by a firewall or disabled in application configuration, this vulnerability cannot be exploited.

This vulnerability presents a low real-world risk despite XSS classification. The CVSS v4.0 vector confirms remote network access (AV:N) but mandates user interaction (UI:P), significantly reducing exploitability compared to CVSS v3.1 conventions. EPSS score of 0.08% (23rd percentile) indicates minimal automated exploitation probability, consistent with XSS requiring targeted social engineering or embedded payloads rather than autonomous network scanning. No CISA KEV designation was provided, so exploitation is not confirmed as active at scale, though publicly available exploit code exists. The vulnerability's impact is rated as integrity violation only (VI:L, VC:N, VA:N), meaning attackers cannot achieve confidentiality breaches or availability denial through this XSS alone. Risk assessment must account for deployment context: if Simple Stock System handles sensitive financial or inventory data accessible to multiple users, stored XSS in a chat function could enable account takeover or data manipulation; conversely, if the application is isolated or used only for internal inventory tracking with limited user bases, risk is negligible. The low EPSS score suggests security teams should deprioritize this below critical patches but should remediate during routine updates.

An attacker crafts a malicious URL containing JavaScript payload targeting the /market/chatuser.php endpoint (e.g., with parameters containing <script>alert('XSS')</script> or an event handler) and embeds it in a phishing email or posts it in a public forum. When a Simple Stock System user clicks the link, the unescaped payload executes in their browser with their authentication context, allowing the attacker to steal session cookies, redirect the user to a credential-harvesting page, or perform unauthorized inventory modifications on behalf of the victim user.