Ship Property Management System CVE-2025-9211

Exploitation requires the attacker to hold a high-privilege authenticated session within the Otalio Ship Property Management System - specifically, write access to the application security page configuration. The NVD CVSS PR:H metric confirms this authentication requirement. The privilege-escalation impact is realized only when a second, higher-privileged user loads the poisoned security page, meaning exploitation is two-stage: payload injection by the first account, and payload execution triggered by victim user interaction. Exploitation is limited to: (1) authenticated attackers with sufficient write privileges to modify the security page, and (2) environments where multiple privilege tiers exist and higher-privileged users regularly access the application security section. No exploitation is possible against unauthenticated users or in single-user deployments.

The NVD CVSS 3.1 score of 6.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) carries a notable inconsistency worth flagging: UI:N (no user interaction) is atypical for stored XSS, which by definition requires a victim to load the injected page before the payload fires. This suggests either the vector was assessed from the attacker's perspective (no interaction required to plant the payload) or a scoring error. An independent assessment placing UI:R and S:C would yield a higher base score and better reflect the actual attack mechanics. The PR:H requirement substantially limits the threat surface - an attacker must already hold high-privilege access before they can implant the payload. However, the privilege-escalation objective means the attacker is likely using a lower-tier privileged account to compromise a higher-tier one, which is a realistic lateral-movement scenario in multi-user maritime management platforms. EPSS data was not provided in source intelligence. No KEV listing and no public POC code have been identified, indicating no confirmed widespread exploitation. Risk is primarily relevant to organizations running Otalio SPMS with multiple privilege tiers and no patch applied.

An attacker with existing high-privileged access to the Ship PMS - such as a vessel operator account - navigates to the application security page and submits a crafted input containing a malicious JavaScript payload. The unescaped value is stored server-side and rendered without sanitization. When a fleet administrator or superuser subsequently loads the security page during routine operations, the script executes in their browser, exfiltrating their session token or performing privileged administrative actions on their behalf.