CVE-2025-9138

How I Found a Stored XSS in Scada-LTS via pointHierarchy/new/ Path Parameter (With PoC and Screenshots)

🇧🇷 Ler em Português.

CVE-2025-9138

Introduction

What if I told you that just adding a new title to a form could compromise a user who opens a page in your system? Can you imagine compromising a system just by filling out a single text field?

In this post, I’ll walk you through how I discovered a Stored XSS vulnerability in the Scada-LTS application — specifically in the pointHierarchy/new/ endpoint — that allows an attacker to inject and persist a JavaScript payload. The exploit is automatically triggered the moment any user accesses the page. No clicks. No warnings.

Let’s go through the technical details, proof of concept, screenshots, and real-world risks involved.

What is CVE-2025-9138?

CVE-2025-9138 is a Stored Cross-Site Scripting (XSS) vulnerability in the pointHierarchy/new/ endpoint of the Scada-LTS application. Stored XSS means the attacker’s payload isn’t just temporarily reflected — it’s saved on the server and executed in every user’s browser when they visit the vulnerable page. That includes admins.

In this case, the problem lies in a path parameter that accepts unsafe input without sanitization, making it possible to persist arbitrary JavaScript code in the system.

Technical Details

➤ Vulnerable Endpoint: pointHierarchy/new/

➤ Payload Used

html

<img src=x onerror=alert(10)>

Proof of Concept (PoC)

Here’s the exact step-by-step I followed to verify the vulnerability:

➤ Go to the endpoint: pointHierarchy/new/

➤ Click on the “+” button to create a new item

➤ In the “Title” field, insert the XSS payload

➤ Click “Yes” to save the entry

Payload executes automatically.

Path Parameter

Impact

This Cross-Site Scripting (XSS) vulnerability can be exploited to:

• Steal session cookies (session hijacking);
• Install malware on victims’ devices;
• Steal credentials stored in the browser;
• Redirect users to malicious websites;
• Deface the application interface;
• Damage the institutional reputation.

Official Sources

The vulnerability was reported ethically and assigned as:

Conclusion

Even a single input field without proper validation can open the door to high-impact attacks.

CVE-2025-9138 highlights the importance of input sanitization at every stage of development. If you work with web applications, it’s important to review all user entry points carefully.

Simple oversights like this one can easily go unnoticed but carry serious risks.

Credits

Discovered with💜 by Karina Gante.

Official Member of CVE-Hunters🏹