CVE-2025-13802: RestaurantWebsite XSS Vulnerability

CVE-2025-13802 Overview

CVE-2025-13802 is a reflected cross-site scripting (XSS) vulnerability in the jairiidriss RestaurantWebsite project, affecting all commits up to e7911f12d035e8e2f9a75e7a28b59e4ef5c1d654. The flaw resides in the Make a Reservation component, where the selected_date argument is rendered without proper sanitization. Attackers can deliver a crafted URL or input that causes arbitrary JavaScript execution in the victim's browser session. The project uses continuous delivery with rolling releases, so no fixed version is identified. Public disclosure of the exploit has occurred, and the vendor did not respond to disclosure attempts.

Critical Impact
Remote attackers can execute arbitrary JavaScript in a visitor's browser by tricking them into loading a malicious reservation URL, enabling session theft, phishing, and content manipulation.

Affected Products

jairiidriss RestaurantWebsite (all commits up to e7911f12d035e8e2f9a75e7a28b59e4ef5c1d654)
Make a Reservation component using the selected_date parameter
Rolling-release deployments without backported sanitization fixes

Discovery Timeline

2025-12-01 - CVE-2025-13802 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-13802

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting issue classified under [CWE-79]. The Make a Reservation feature accepts a user-supplied selected_date parameter and reflects it into the rendered HTML response without encoding or validation. An attacker can embed JavaScript payloads within this parameter, which the browser then executes in the origin context of the vulnerable site.

Because the application operates under continuous delivery with rolling releases, there are no discrete patched versions to track. Operators running any deployment built from a commit at or before e7911f12d035e8e2f9a75e7a28b59e4ef5c1d654 should assume exposure. The attack requires user interaction, typically through a crafted link, but no authentication is needed.

Root Cause

The root cause is missing output encoding of the selected_date request parameter before it is written into HTML. The reservation handler trusts the client-supplied value and concatenates it into the response DOM. This violates standard input validation and contextual output encoding practices for web applications.

Attack Vector

The attack vector is network-based and remote. An attacker constructs a URL that targets the reservation endpoint, embedding a JavaScript payload in the selected_date query parameter. The victim must click the link or otherwise load the malicious URL. Once the response is rendered, the injected script runs with the privileges of the user's session on the vulnerable site, enabling cookie theft, credential harvesting through fake forms, or redirection to attacker-controlled infrastructure.

No verified proof-of-concept code is available in the referenced sources. Technical details and the vulnerability report are documented in the GitHub Report Document and tracked in VulDB #333812.

Detection Methods for CVE-2025-13802

Indicators of Compromise

Web server access logs containing selected_date parameter values with HTML or JavaScript syntax such as <script>, onerror=, javascript:, or URL-encoded equivalents like %3Cscript%3E.
Referrer headers from suspicious or unknown domains pointing visitors to the reservation endpoint with unusual query strings.
Browser content security policy (CSP) violation reports referencing inline script execution on reservation pages.

Detection Strategies

Inspect application and reverse proxy logs for reservation requests containing angle brackets, event handler attributes, or encoded script payloads in selected_date.
Deploy a web application firewall (WAF) rule set that flags reflected XSS patterns targeting the reservation endpoint.
Run authenticated DAST scans against the Make a Reservation form to confirm whether the parameter is reflected unsanitized into responses.

Monitoring Recommendations

Forward web server logs to a centralized analytics platform and alert on anomalous query string patterns hitting reservation routes.
Monitor outbound HTTP requests from end-user browsers for unexpected destinations that may indicate post-exploitation data exfiltration.
Track CSP report-uri or report-to endpoints for spikes in policy violations associated with reservation pages.

How to Mitigate CVE-2025-13802

Immediate Actions Required

Disable or restrict public access to the Make a Reservation feature until input handling is remediated.
Apply server-side input validation that rejects any selected_date value not matching a strict date format such as YYYY-MM-DD.
Add contextual output encoding for all user-controlled values rendered into HTML, attributes, or JavaScript contexts.

Patch Information

No official vendor patch is available. The vendor did not respond to disclosure outreach, and the rolling-release distribution model means downstream operators must apply fixes themselves. Fork maintainers and self-hosters should add explicit validation and encoding for the selected_date parameter in the reservation handler, then rebuild and redeploy. Track upstream activity through the project's commit history and the VulDB CTI ID #333812 advisory.

Workarounds

Front the application with a WAF that blocks requests where selected_date contains characters outside the expected date character set.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and Secure flags on session cookies to limit the impact of script-based session theft.

bash

# Example NGINX rule to block obvious XSS payloads in selected_date
if ($arg_selected_date ~* "(<|>|script|onerror|javascript:|%3C|%3E)") {
    return 403;
}