Vembu BDRSuite CVE-2025-71451

Reflected, unauthenticated XSS in templates/progress/serverside/serverbackupprogress.sgp of Vembu BDRSuite versions before 7.6.0: the ClientName, BackupName, and grpName request parameters are interpolated unsanitized into loadXMLDoc() calls and reflected into AbortBackup() POST requests to dodeleteclientbackup.sgp. Exploitation requires the attacker to craft a malicious link or request AND a victim (an operator with a browser session) to open/trigger it - the CVSS UI:A metric confirms required user interaction, which is the primary limiting factor. No authentication is required of the attacker (PR:N), but there is no server-side impact; the effect is confined to the victim's browser session. Fixed in version 7.6.0; the vendor update is the remediation indicated by the evidence.

This is a moderate, not emergency, priority. The CVSS 4.0 base score is 5.1 with vector AV:N/AC:L/AT:N/PR:N/UI:A - network-reachable and unauthenticated (PR:N), but requiring active user interaction (UI:A), i.e. a victim must follow or trigger an attacker-crafted link/request. Impact is confined to the subsequent (browser) system (SC:L/SI:L) with no direct impact to the vulnerable server's own confidentiality, integrity or availability (VC:N/VI:N/VA:N), consistent with a reflected cross-site scripting flaw (CWE-79). No KEV listing is present and no EPSS score was supplied, so there is no evidence of active exploitation or a quantified exploitation probability. A public write-up/PoC reference exists but is not verified as working exploit code, so this signals disclosure and researcher attention (reported by VulnCheck) rather than confirmed in-the-wild use. The vendor priority decision label is 'this_month', which aligns with a real-but-not-critical issue: patch in the normal remediation cycle rather than as an emergency. The main gating factor keeping real-world risk below the raw CVSS is the required user interaction and the lack of server-side impact.

An attacker crafts a malicious URL targeting serverbackupprogress.sgp with poisoned ClientName, BackupName, or grpName parameters and lures an authenticated BDRSuite operator into opening it; the unsanitized values are interpolated into loadXMLDoc() calls and reflected into the AbortBackup() POST, executing attacker JavaScript in the victim's session. This enables session hijacking or manipulation of the backup management interface. A public PoC reference exists but is not verified as working exploit code, and exploitation requires the victim to act on the crafted link (UI:A).