Full Report
Cross-site Scripting (XSS) vulnerability (CVE-2025-7761) has been found in Akcess-Net Lepszy BIP software.
Analysis Summary
# Vulnerability: Cross-Site Scripting (XSS) in Akcess-Net Lepszy BIP Software
## CVE Details
- CVE ID: CVE-2025-7761
- CVSS Score: Not provided in the source, assumed Medium/High due to XSS nature.
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'))
## Affected Systems
- Products: Akcess-Net Lepszy BIP software
- Versions: All versions (This implies no specific fix version is known/available yet, or all versions checked are vulnerable).
- Configurations: Vulnerability exists within the `index.php` form parameter handling.
## Vulnerability Description
The Lepszy BIP software is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability stems from improper input validation within a parameter in the `index.php` form. An attacker can craft a malicious URL that, when opened by a victim, causes arbitrary JavaScript code to be executed within the victim's browser context.
## Exploitation
- Status: PoC available (Implied via the nature of finding and reporting a specific XSS vulnerability, although explicit statement is missing, XSS vulnerabilities are often readily reproducible).
- Complexity: Low (Reflected XSS often requires only delivering a malicious link).
- Attack Vector: Network (Requires victim to click a specially crafted URL).
## Impact
- Confidentiality: Potential compromise (Session hijacking, credential theft).
- Integrity: Potential compromise (Content alteration, unauthorized actions on behalf of the user).
- Availability: Low (Primary impact is on user sessions/data, not system uptime).
## Remediation
### Patches
- No specific patch version or update was provided in the source material, as the vendor reportedly did not respond to disclosure efforts.
### Workarounds
- Because the vulnerability relies on user interaction via a crafted URL, potential workarounds include strict filtering of incoming links and educating users not to click on suspicious URLs. (Note: No official vendor workarounds were provided).
## Detection
- **Indicators of Compromise:** Observing unusual outbound network activity from the victim's browser session associated with the Lepszy BIP application, or unexpected page behavior/redirections after navigating to specific links related to the application.
- **Detection Methods and Tools:** Web Application Firewalls (WAFs) configured with strict XSS pattern matching rules, and static/dynamic application security testing (SAST/DAST) tools used against the application endpoints, specifically testing input fields in `index.php`.
## References
- Vendor Advisories: None available (Vendor did not respond).
- Relevant links - defanged:
- hxxps://www.cve.org/CVERecord?id=CVE-2025-7761
- hxxps://cert.pl/en/cvd/