Codeastro Internet Banking System: Stored Cross-Site Scripting (CVE-2025-29018)

Codeastro Internet Banking System 2.0.0 is vulnerable to a stored cross-site scripting (XSS) attack via the 'name' parameter in 'pages_add_acc_type.php'. The vulnerability allows an authenticated attacker with high-level privileges to inject arbitrary JavaScript, which executes when an administrator or user views the 'Manage Acc Types' administrative page.

Attack Chain

1. Attacker authenticates to the application with privileges sufficient to add account types.
2. Attacker navigates to the "Add Acc Type" functionality.
3. Attacker submits a malicious payload containing JavaScript within the 'name' parameter field.
4. The application saves the unsanitized payload into the backend database.
5. An administrator or user accesses the "Manage Acc Types" administrative menu.
6. The application renders the stored payload within the admin interface, triggering JavaScript execution in the victim's browser session.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of the victim's browser session. Documented potential impacts include session hijacking, credential theft, and unauthorized account takeover.

Recommendation

• Identify and inventory all instances of Codeastro Internet Banking System 2.0.0 within the environment.
• Implement strict HTML entity encoding for all user-supplied input fields, specifically the 'name' parameter in 'pages_add_acc_type.php'.
• Deploy a robust Content Security Policy (CSP) to restrict the execution of unauthorized inline scripts.
• Until a patch is provided, restrict access to administrative functions and audit logs for anomalous changes to account type definitions.