{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/internet-banking-system-2.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:codeastro:internet_banking_system:2.0.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":4.8,"id":"CVE-2025-29018"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Internet Banking System (2.0.0)"],"_cs_severities":["low"],"_cs_tags":["web-vulnerability","xss","injection"],"_cs_type":"advisory","_cs_vendors":["Codeastro"],"content_html":"\u003cp\u003eCodeastro Internet Banking System 2.0.0 is vulnerable to a stored cross-site scripting (XSS) attack via the 'name' parameter in 'pages_add_acc_type.php'. The vulnerability allows an authenticated attacker with high-level privileges to inject arbitrary JavaScript, which executes when an administrator or user views the 'Manage Acc Types' administrative page.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the application with privileges sufficient to add account types.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the \u0026quot;Add Acc Type\u0026quot; functionality.\u003c/li\u003e\n\u003cli\u003eAttacker submits a malicious payload containing JavaScript within the 'name' parameter field.\u003c/li\u003e\n\u003cli\u003eThe application saves the unsanitized payload into the backend database.\u003c/li\u003e\n\u003cli\u003eAn administrator or user accesses the \u0026quot;Manage Acc Types\u0026quot; administrative menu.\u003c/li\u003e\n\u003cli\u003eThe application renders the stored payload within the admin interface, triggering JavaScript execution in the victim's browser session.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary JavaScript in the context of the victim's browser session. Documented potential impacts include session hijacking, credential theft, and unauthorized account takeover.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify and inventory all instances of Codeastro Internet Banking System 2.0.0 within the environment.\u003c/li\u003e\n\u003cli\u003eImplement strict HTML entity encoding for all user-supplied input fields, specifically the 'name' parameter in 'pages_add_acc_type.php'.\u003c/li\u003e\n\u003cli\u003eDeploy a robust Content Security Policy (CSP) to restrict the execution of unauthorized inline scripts.\u003c/li\u003e\n\u003cli\u003eUntil a patch is provided, restrict access to administrative functions and audit logs for anomalous changes to account type definitions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T07:59:32Z","date_published":"2026-10-29T07:59:32Z","id":"https://feed.craftedsignal.io/briefs/2026-10-codeastro-xss/","summary":"Codeastro Internet Banking System 2.0.0 contains a stored XSS vulnerability in the pages_add_acc_type.php component that allows authenticated attackers to inject malicious JavaScript, potentially leading to session hijacking.","title":"Codeastro Internet Banking System: Stored Cross-Site Scripting (CVE-2025-29018)","url":"https://feed.craftedsignal.io/briefs/2026-10-codeastro-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Internet Banking System (2.0.0)","version":"https://jsonfeed.org/version/1.1"}