ASPL Product Quotation - Reflected cross-site scripting (XSS)

Summary

Name	ASPL Product Quotation 1. - Reflected cross-site scripting (XSS)
Code name	skims-0042
Product	ASPL Product Quotation
Affected versions	Version 1.
State	Private
Release date	2025-03-14

Vulnerability

Kind	Reflected cross-site scripting (XSS)
Rule	Reflected cross-site scripting (XSS)
Remote	No
CVSSv4 Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:U
CVSSv4 Base Score	4.8 (Medium)
Exploit available	No
CVE ID(s)	CVE-2025-31312

Description

ASPL Product Quotation 1. was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/product_quotation.php.

Vulnerability

Skims by Fluid Attacks discovered a Reflected cross-site scripting (XSS) in ASPL Product Quotation 1.. The following is the output of the tool:

Skims output

 238 | function product_quote_list_page(){
 239 |
 240 | $testListTable = new product_quote_List_Table();
 241 |
 242 | ?>
 243 | <div class=""wrap"">
 244 | <div id=""icon-users"" class=""icon32""><br/></div>
 245 | <h2>Quote Request List</h2>
 246 |
 247 | <?php
 248 | $testListTable->views();
 249 | ?>
 250 | <form id=""movies-filter"" method=""get"">
> 251 | <input type=""hidden"" name=""page"" value=""<?php echo $_REQUEST['page'] ?>"" />
 252 | <?php
 253 |
 254 | if( isset($_GET['s']) ){
 255 | $testListTable->prepare_items($_GET['s']);
 256 | } else {
 257 | $testListTable->prepare_items();
 258 | }
 259 |
 260 | $testListTable->search_box( 'search', 'search_id-search-input' );
 261 | $testListTable->display();
 262 |
 263 | ?>
 264 | </form>
 265 | </div>
  266 |       <?php
  267 |   }
      ^ Col 0

Our security policy

We have reserved the ID CVE-2025-31312 to refer to this issue from now on.

• https://fluidattacks.com/advisories/policy/

System Information

• Product: ASPL Product Quotation
• Version: 1.

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Andres Roldan from Fluid Attacks' Offensive Team using Skims

Timeline