CVE-2025-14991: Beauty Parlor Management System XSS Vulnerability

CVE-2025-14991 Overview

CVE-2025-14991 is a reflected cross-site scripting (XSS) vulnerability in Campcodes Complete Online Beauty Parlor Management System 1.0. The flaw resides in /admin/bwdates-reports-details.php, where the fromdate parameter is rendered without proper output encoding. An authenticated attacker can supply crafted input to execute arbitrary JavaScript in the browser of an administrator viewing the reports page. Public exploit details have been published, lowering the barrier to entry for attackers targeting deployed instances. The vulnerability is classified under CWE-79.

Critical Impact
A successful attack can hijack administrator sessions, tamper with rendered report data, or redirect operators to attacker-controlled resources.

Affected Products

Campcodes Complete Online Beauty Parlor Management System 1.0
Affected file: /admin/bwdates-reports-details.php
Affected parameter: fromdate

Discovery Timeline

2025-12-21 - CVE-2025-14991 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14991

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the admin reporting workflow. When an administrator submits a date range through the reports form, the application echoes the fromdate GET/POST parameter back into the HTML response without sanitization or contextual encoding. An attacker who convinces an authenticated admin to click a malicious link can trigger script execution in the admin's browser context. Because the flaw sits in the /admin/ directory, exploitation targets privileged sessions, enabling session token theft, unauthorized administrative actions, or defacement of report views. The exploit is publicly available through the referenced GitHub issue, which discusses the underlying weakness.

Root Cause

The root cause is missing output encoding on the fromdate argument inside bwdates-reports-details.php. User-controlled input is concatenated into HTML output without functions such as htmlspecialchars() or context-aware escaping. There is no input validation to constrain fromdate to an expected date format before rendering.

Attack Vector

Exploitation requires network access to the admin interface and user interaction from a privileged operator. The attacker crafts a URL pointing to /admin/bwdates-reports-details.php with a malicious payload in fromdate, then delivers it via phishing or a chat channel. When the authenticated administrator loads the URL, the injected JavaScript executes with the admin's session privileges.

No verified proof-of-concept code is published in the referenced sources beyond parameter-level details. See the VulDB entry for the tracked disclosure.

Detection Methods for CVE-2025-14991

Indicators of Compromise

Web server access logs containing bwdates-reports-details.php requests with fromdate values that include <script>, onerror=, javascript:, or URL-encoded equivalents such as %3Cscript%3E.
Referer headers pointing to external or unknown domains preceding admin report requests.
Unexpected outbound requests from admin browsers to attacker-controlled hosts following report page visits.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set that inspects query and body parameters on /admin/ endpoints for XSS payload signatures.
Enable server-side logging of full request URIs and POST bodies for the admin panel, then alert on tag-like patterns in fromdate.
Correlate admin session activity with anomalous JavaScript execution patterns using browser telemetry where available.

Monitoring Recommendations

Monitor administrator accounts for session anomalies including geographic changes, new user agents, or unexpected privileged actions after report page usage.
Track HTTP 200 responses to the vulnerable endpoint alongside response bodies containing reflected script markers.
Review authentication logs for admin logins followed immediately by report queries carrying unusual parameter payloads.

How to Mitigate CVE-2025-14991

Immediate Actions Required

Restrict access to /admin/bwdates-reports-details.php at the network or web server layer to trusted administrative IP ranges.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts on the admin interface to blunt reflected XSS payloads.
Require administrators to log out of active sessions before clicking any external links, and enable short session timeouts on the admin panel.

Patch Information

No vendor patch is listed in the referenced sources at time of publication. Track updates through the CampCodes site and the VulDB CTI entry for release notifications. Until a fix ships, apply the workarounds below.

Workarounds

Add server-side validation on fromdate to accept only values matching an expected date format such as YYYY-MM-DD and reject all others.
Wrap the reflected fromdate output in htmlspecialchars($fromdate, ENT_QUOTES, 'UTF-8') before rendering it in the HTML response.
Deploy a WAF rule blocking requests to bwdates-reports-details.php where fromdate contains angle brackets, javascript:, or event handler substrings.

bash

# Example nginx rule to block XSS payloads in fromdate
if ($arg_fromdate ~* "(<|>|script|onerror|onload|javascript:)") {
    return 403;
}