This vulnerability (CVE-2025-8308) involves improper input sanitization in the INFOREX- General Information Management System by Key Software Solutions Inc., leading to cross-site scripting (CWE-79). The flaw allows an attacker to inject malicious scripts via HTTP headers, which are then executed in the context of the affected web application. The issue affects all versions from 2025 and before through 18022026. The vendor has not issued any response or patch. The CVSS 3.1 score of 6.3 reflects network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the vulnerable web application, potentially leading to limited confidentiality, integrity, and availability impacts as indicated by the CVSS score. This could result in session hijacking, information disclosure, or manipulation of web content for affected users. However, no known exploits in the wild have been reported.

No official patch or remediation is currently available from the vendor, as they have not responded to disclosure attempts. Users should monitor vendor communications for updates. Until a fix is provided, consider implementing web application firewall (WAF) rules to detect and block suspicious HTTP header inputs that may contain script code. Additionally, applying input validation and output encoding at the application level, if possible, can help mitigate the risk.