CVE-2025-0530
Published: 17 January 2025
Summary
CVE-2025-0530 is a low-severity Cross-site Scripting (CWE-79) vulnerability in Anisha Job Recruitment. Its CVSS base score is 3.5 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents XSS by validating the manipulated 'type' argument in /_parse/_feedback_system.php to ensure only expected inputs are processed.
SI-15 comprehensively mitigates reflected XSS by filtering outputs generated from the unneutralized 'type' input before rendering in web pages.
SI-2 addresses the root cause by identifying and remediating the improper neutralization flaw in the Job Recruitment application's feedback system code.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
XSS vulnerability in public-facing web application enables exploitation for initial access (T1190) and malicious JavaScript execution (T1059.007) as mapped by VulDB.
NVD Description
A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. This vulnerability affects unknown code of the file /_parse/_feedback_system.php. The manipulation of the argument type leads to cross site scripting. The attack can be initiated remotely.…
more
The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-0530 is a cross-site scripting (XSS) vulnerability in code-projects Job Recruitment 1.0, affecting unknown code within the file /_parse/_feedback_system.php. The flaw stems from manipulation of the "type" argument, resulting in reflected XSS, and is classified as problematic with a CVSS v3.1 base score of 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N). It is associated with CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-94 (Improper Control of Generation of Code).
A remote attacker with low privileges can exploit this vulnerability by manipulating the "type" argument, though it requires user interaction to succeed. Exploitation enables limited integrity impact, such as injecting malicious scripts into web pages viewed by users, potentially leading to session hijacking or phishing in the context of the application's feedback system.
Advisories reference the project site at code-projects.org, a GitHub repository containing exploit details at github.com/ha0day125/cve/blob/main/xss-ha0day.md, and multiple VulDB entries (vuldb.com/?ctiid.292414, vuldb.com/?id.292414, vuldb.com/?submit.478674). The exploit has been publicly disclosed and may be used by attackers. No patches or specific mitigations are detailed in the available information.
Details
- CWE(s)