OpenCode USSD Gateway Reflected XSS Vulnerability (CVE-2025-65237)

CVE-2025-65237: USSD Gateway Reflected Cross-Site Scripting Description Reflected Cross-Site Scripting in the USSD Gateway application provided by OpenCode Systems allows a user with access to the vulnerable function to execute JavaScript code against a victim. Application Details Name: USSD Gateway Vendor: OpenCode Systems Version: OC Release 5 - Version 6.13.11 Technical Details Vulnerable Endpoint: /occontrolpanel/index.php?w=ocussd&m=sessions&a=list_sessions&flt_sessid= Vulnerable Parameter: flt_sessid Payload Sample: flt_sessid=6"> Exploitation This vulnerability involves a chain of two vulnerabilities that enable conversion from self-XSS to reflected XSS. After login, the server assigns cookies to the user without setting the attribute to , allowing the attacker to change the request from GET to POST to bypass the CSRF verification parameter in the POST body. By converting the request back from POST to GET and either removing the CSRF verification parameter’s value or the entire parameter, and resending it, a vulnerable URL can be shared with other users. Nuclei Template ```yaml id: ocpnanel-ussdgw-xss info: name: USSD Gateway OCP Control Panel Reflected XSS author: Eslam Ali Ak1 @eslam3kl severity: Medium description: | Reflected XSS test for the OCP Control Panel USSD Gateway session. Injects a simple XSS payload into the flt_sessid parameter and flags the target if the payload is reflected unescaped in the HTML response. tags: [xss, reflected, ocpnanel, ussdgw] requests: - id: reflected_xss method: GET path: - "{{BaseURL}}/occontrolpanel/index.php?w=ocussd&m=sessions&a=list_sessions&fl [[URL] &lc

Goal Reached Thanks to every supporter — we hit 100%!

OpenCode USSD Gateway Reflected XSS Vulnerability (CVE-2025-65237)