CVE-2025-14200
📋 TL;DR
This CVE describes a cross-site scripting (XSS) vulnerability in the Hotel-Management-services-using-MYSQL-and-php software. Attackers can inject malicious scripts via the /usersub.php file's Request Pending Page component, potentially compromising user sessions or stealing credentials. Anyone using this hotel management software up to commit 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f is affected.
💻 Affected Systems
- alokjaiswal Hotel-Management-services-using-MYSQL-and-php
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, hijack user sessions, deface the website, or redirect users to malicious sites, potentially leading to complete system compromise.
Likely Case
Attackers inject malicious JavaScript to steal session cookies or credentials from users visiting the vulnerable page, leading to account takeover.
If Mitigated
With proper input validation and output encoding, malicious scripts would be neutralized, preventing any exploitation.
🎯 Exploit Status
Exploit details are publicly available in the GitHub document. Remote exploitation is possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider applying manual fixes or workarounds.
🔧 Temporary Workarounds
Input Validation and Output Encoding
allImplement proper input validation and output encoding in /usersub.php to sanitize user inputs before processing and rendering.
Edit /usersub.php to add htmlspecialchars() or htmlentities() around user-controlled outputs
Content Security Policy
allImplement a strict Content Security Policy header to prevent execution of inline scripts and unauthorized sources.
Add header("Content-Security-Policy: default-src 'self'") to PHP files
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with XSS protection rules
- Disable or restrict access to the vulnerable /usersub.php endpoint if not essential
🔍 How to Verify
Check if Vulnerable:
Check if your installation uses commit 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f or earlier by examining git history or comparing file hashes.Check Version:
git log --oneline | head -1Verify Fix Applied:
Test the /usersub.php endpoint with XSS payloads like <script>alert('test')</script> to ensure they are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /usersub.php containing script tags or JavaScript code
- Multiple failed XSS attempts in web server logs
Network Indicators:
- HTTP requests with suspicious parameters containing script tags or encoded payloads
SIEM Query:
source="web_server" AND uri="/usersub.php" AND (request_body LIKE "%<script>%" OR request_body LIKE "%javascript:%")🔗 References
- https://github.com/Yh276/h0202/blob/main/Hotel-Management-services-using-MYSQL-and-php%20web%202xxs.docx
- https://vuldb.com/?ctiid.334620
- https://vuldb.com/?id.334620
- https://vuldb.com/?submit.699993
- https://github.com/Yh276/h0202/blob/main/Hotel-Management-services-using-MYSQL-and-php%20web%202xxs.docx
