Author Periodic Report - Reflected cross-site scripting (XSS)

Summary

Name	Author Periodic Report - Reflected cross-site scripting (XSS)
Code name	skims-0034
Product	Author Periodic Report
Affected versions	Version
State	Private
Release date	2025-03-14

Vulnerability

Kind	Reflected cross-site scripting (XSS)
Rule	Reflected cross-site scripting (XSS)
Remote	No
CVSSv4 Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:U
CVSSv4 Base Score	4.8 (Medium)
Exploit available	No
CVE ID(s)	CVE-2025-31307

Description

Author Periodic Report

was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/php/report.php.

Vulnerability

Skims by Fluid Attacks discovered a Reflected cross-site scripting (XSS) in Author Periodic Report . The following is the output of the tool:

Skims output

 3 | function view() {
 4 |
 5 | $month=$_GET[""month""];
 6 | if(!$month)$month=date(n);
 7 | $m[$month]=""selected"";
 8 |
 9 | $year=$_GET[""year""];
 10 | if(!$year)$year=date(Y);
 11 | ?>
 12 |
 13 |
 14 | <div class=""wrap"">
 15 | <div id=""author-periodic-report"">
 16 |
 17 | <h2>Author Periodic Report</h2>
 18 | <br/>
 19 |
 20 | <form method=""GET"" action="""">
 21 | <div>
 22 | <label>Select Month: </label>
 23 |
 24 | <select name=""month"" id=""month"" />
 25 | <?php
 26 | for($i=1; $i<=12; $i++)
 27 | echo ""<option value='"",$i,""' "",$m[$i],"">"", date('F',mktime(0,0,0,$i,10)) ,""</option>"";
 28 | ?>
 29 | </select>
 30 |
 31 | <input type=""text"" name=""year"" id=""year"" value=""<?=$year;?>""/>
 32 |
 33 | <input type=""submit"" id=""display_report"" value=""Display Report""/>
> 34 | <input type=""hidden"" name=""page"" value=""<?php echo $_GET['page']?>""/>
 35 | </div>
 36 | </form>
 37 |
 38 | </div>
  39 |
  40 |
  41 |
  42 | <?php
  43 |
  44 | include_once(PERIODIC_REPORT_ROOT . '/php/display_report.php');
  45 | }
     ^ Col 0

Our security policy

We have reserved the ID CVE-2025-31307 to refer to this issue from now on.

• https://fluidattacks.com/advisories/policy/

System Information

• Product: Author Periodic Report
• Version:

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Andres Roldan from Fluid Attacks' Offensive Team using Skims

Timeline