CVE-2025-5975
📋 TL;DR
This cross-site scripting (XSS) vulnerability in PHPGurukul Rail Pass Management System allows attackers to inject malicious scripts via the 'searchdata' parameter in the /rpms/download-pass.php file. The vulnerability can be exploited remotely to execute arbitrary JavaScript in victims' browsers. Organizations using Rail Pass Management System 1.0 are affected.
💻 Affected Systems
- PHPGurukul Rail Pass Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, perform actions on behalf of authenticated users, or deliver malware payloads to system administrators.
Likely Case
Attackers inject malicious scripts that steal user session cookies or credentials, potentially leading to account compromise and unauthorized access to the rail pass management system.
If Mitigated
With proper input validation and output encoding, the XSS payloads would be neutralized, preventing script execution while maintaining search functionality.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates. Consider implementing workarounds or replacing the software.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize the searchdata parameter before processing
Modify /rpms/download-pass.php to include: $searchdata = htmlspecialchars($_GET['searchdata'], ENT_QUOTES, 'UTF-8');
Content Security Policy
allImplement CSP headers to restrict script execution sources
Add to .htaccess: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
Add to PHP: header("Content-Security-Policy: default-src 'self'; script-src 'self'");
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads in searchdata parameter
- Restrict access to /rpms/download-pass.php to authenticated users only
🔍 How to Verify
Check if Vulnerable:
Test by accessing /rpms/download-pass.php?searchdata=<script>alert('XSS')</script> and checking if script executesCheck Version:
Check system documentation or contact vendor. No standard version command available.Verify Fix Applied:
After implementing fixes, test with same payload and verify script does not execute and input is properly encoded📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /rpms/download-pass.php containing script tags or JavaScript in searchdata parameter
- Unusual search patterns with encoded payloads
Network Indicators:
- HTTP GET requests with suspicious parameters containing JavaScript or HTML tags
SIEM Query:
source="web_logs" AND uri_path="/rpms/download-pass.php" AND (query="*<script>*" OR query="*javascript:*" OR query="*onerror=*" OR query="*onload=*")