CVE-2025-40615: Bookgy Reflected XSS Vulnerability

CVE-2025-40615 Overview

CVE-2025-40615 is a reflected Cross-Site Scripting (XSS) vulnerability in Bookgy, a booking and reservation platform. The flaw resides in the /api/api_ajustes.php endpoint, where the TEXTO parameter is reflected into the HTTP response without adequate sanitization or output encoding. An attacker can craft a malicious URL containing JavaScript payloads and deliver it to a victim through phishing or social engineering. When the victim opens the link, the injected script executes in the browser under the origin of the vulnerable Bookgy application. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session data theft, UI manipulation, and phishing pivots against authenticated Bookgy users.

Affected Products

Bookgy (all versions as identified in the vendor advisory)
Endpoint: /api/api_ajustes.php
Vulnerable parameter: TEXTO

Discovery Timeline

2025-04-29 - CVE-2025-40615 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40615

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the Bookgy web application. User-controlled input supplied through the TEXTO query parameter in the /api/api_ajustes.php endpoint is echoed back into the HTTP response without proper output encoding or input validation. Because the response is rendered in the browser as HTML or executable script context, an attacker-controlled payload becomes active JavaScript.

Exploitation requires user interaction. The attacker must convince a target to click a crafted link, typically delivered by email, chat, or an embedded link on a controlled site. Once the link is loaded, script executes under the Bookgy origin, giving the attacker access to same-origin resources such as cookies not protected by HttpOnly, DOM contents, and authenticated API endpoints.

Root Cause

The root cause is missing neutralization of special characters in the TEXTO request parameter before it is included in the server response. The application does not apply HTML entity encoding, does not enforce a strict allowlist of characters, and does not implement a Content Security Policy (CSP) that would restrict inline script execution. This aligns with the CWE-79 weakness pattern.

Attack Vector

The attack vector is network-based and requires no privileges. The attacker crafts a URL of the form https://<bookgy-host>/api/api_ajustes.php?TEXTO=<payload> where the payload contains HTML or JavaScript such as <script> blocks or event-handler attributes. When the victim opens the URL in an authenticated session, the payload runs with the privileges of that user. Refer to the INCIBE Security Notice for the full advisory.

Detection Methods for CVE-2025-40615

Indicators of Compromise

HTTP requests to /api/api_ajustes.php containing a TEXTO parameter with URL-encoded HTML tags such as %3Cscript%3E, %3Cimg, or onerror=.
Referer headers pointing to external, unfamiliar domains for requests targeting api_ajustes.php.
Sudden spikes in outbound requests from client browsers to attacker-controlled domains immediately after visiting Bookgy URLs.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the TEXTO parameter and blocks payloads containing script tags, event handlers, or javascript: URIs.
Review web server access logs for query strings on /api/api_ajustes.php containing suspicious keywords: script, onerror, onload, alert(, document.cookie, %3C, %3E.
Enable browser Content Security Policy violation reporting to identify inline script execution attempts against production origins.

Monitoring Recommendations

Alert on anomalous URL lengths or high entropy in the TEXTO parameter on the /api/api_ajustes.php endpoint.
Correlate email gateway telemetry with web traffic to flag users who follow externally sourced links to Bookgy containing query parameters.
Track session token reuse from disparate IP addresses following exposure to suspicious Bookgy URLs.

How to Mitigate CVE-2025-40615

Immediate Actions Required

Contact Bookgy for the current patched release and apply it as soon as it is available in your environment.
Configure a WAF rule to reject or sanitize requests to /api/api_ajustes.php whose TEXTO parameter contains HTML metacharacters (<, >, ", ', &).
Set the HttpOnly and Secure flags on session cookies to reduce cookie theft risk from injected scripts.
Notify users of the phishing risk and instruct them to avoid clicking Bookgy links received from untrusted sources.

Patch Information

At time of publication, no specific patched version is listed in the NVD entry. Consult the INCIBE Security Notice on multiple Bookgy vulnerabilities and contact the vendor directly for remediation guidance and fixed builds.

Workarounds

Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Apply server-side output encoding to any reflection of the TEXTO parameter, using context-appropriate HTML entity encoding.
Restrict access to /api/api_ajustes.php at the network or reverse-proxy layer to authenticated administrative sessions only, if the endpoint is not required for general users.

bash

# Example NGINX rule to block obvious XSS payloads in TEXTO parameter
location /api/api_ajustes.php {
    if ($arg_TEXTO ~* "(<|%3C)(script|img|svg|iframe)") {
        return 403;
    }
    if ($arg_TEXTO ~* "(onerror|onload|javascript:)") {
        return 403;
    }
    proxy_pass http://bookgy_backend;
}