Listen to this Post
This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the SysReptor pentest reporting platform for versions prior to 2025.102. It allows any authenticated user to upload malicious JavaScript files through the platform’s web interface. The core failure is the platform’s improper neutralization of user input during web page generation (CWE-79). Once uploaded, these malicious files are stored on the server. When another logged-in user later accesses a page that loads the uploaded file, the malicious JavaScript executes automatically within that victim’s browser session. This execution happens in the context of the victim’s session, meaning the script can perform any action the victim is authorized to do. Attackers can leverage this to hijack user sessions by stealing authentication cookies or tokens. It also enables theft of sensitive data viewed by the victim, such as confidential pentest reports and findings stored in the platform. Furthermore, the script can perform unauthorized actions on behalf of the victim, like modifying or deleting report data. The attack requires the attacker to have a valid user account, but even low-privilege credentials are sufficient for exploitation. Successful exploitation compromises the confidentiality and integrity of the platform but does not affect system availability. The vulnerability was fixed in version 2025.102 by implementing proper input validation and sanitization for uploaded files.
DailyCVE Form
Platform: SysReptor platform
Version: Before 2025.102
Vulnerability : Stored XSS
Severity: High
date: 2025-12-04
Prediction: Patch released 2025-12-04
What Undercode Say:
Check current SysReptor version
curl -s http://localhost:8000/api/version | grep version
Example malicious JS file for PoC analysis (save as malicious.js)
alert(document.cookie);
fetch('/api/user/data', {method: 'POST', body: localStorage.getItem('tokens')});
Download the patched version (2025.102) directly
wget https://github.com/Syslifters/sysreptor/archive/refs/tags/v2025.102.tar.gz
How Exploit:
1. Attacker logs into SysReptor.
2. Attacker navigates to file upload function.
- Attacker uploads a `.js` file containing malicious payload.
4. File is saved on the server.
- Victim logs in and views page referencing the file.
6. Malicious script runs in victim’s browser.
7. Script steals session data/pentest reports.
Protection from this CVE
- Immediately upgrade to SysReptor version 2025.102.
- Implement strict Content Security Policy (CSP) headers.
- Sanitize all user-uploaded file content.
- Conduct audit for previously uploaded files.
Impact:
- Session hijacking and credential theft.
- Theft of sensitive pentest report data.
- Unauthorized actions via victim’s account.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
