The vulnerability resides in an unknown function of the /?route=customers/edit page within the Customer Handler component of BichitroGan ISP Billing Software 2025.3.20. It allows an attacker to inject malicious script code that is executed in users' browsers when they view edited customer data. This classic cross‑site scripting flaw (CWE‑79) is coupled with a potential server‑side code execution indication (CWE‑94). The primary impact is execution of arbitrary client‑side code leading to session hijacking, phishing, or site defacement, thereby compromising confidentiality and integrity of user sessions.

The affected product is BichitroGan ISP Billing Software 2025.3.20. No sub‑components or alternate versions are listed; any instance of the Customer edit route exposed to external traffic is vulnerable.

The CVSS score of 4.8 indicates a moderate impact and requires remote interaction. EPSS information is not available, so exact exploitation probability cannot be quantified, though a public exploit demonstrates feasibility. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote via a crafted request to the edit customer route, impacting any user that views responses containing injected script.