CVE-2025-40616: Bookgy Reflected XSS Vulnerability

CVE-2025-40616 Overview

CVE-2025-40616 is a reflected Cross-Site Scripting (XSS) vulnerability in Bookgy, a web-based booking and reservation platform. The flaw resides in the /bkg_imprimir_comprobante.php endpoint, which fails to sanitize the IDRESERVA parameter before reflecting it back into the HTTP response. An attacker can craft a malicious URL that executes arbitrary JavaScript in the victim's browser when clicked. The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation. Spain's INCIBE-CERT published the coordinated disclosure covering multiple Bookgy vulnerabilities.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session data theft, credential harvesting, and unauthorized actions against the Bookgy application.

Affected Products

Bookgy (all versions at time of disclosure)
Endpoint: /bkg_imprimir_comprobante.php
Vulnerable parameter: IDRESERVA

Discovery Timeline

2025-04-29 - CVE-2025-40616 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40616

Vulnerability Analysis

The vulnerability is a reflected XSS flaw affecting the bkg_imprimir_comprobante.php script in Bookgy. This script generates a printable reservation receipt using the IDRESERVA query parameter supplied in the request URL. The application takes the parameter value and embeds it directly into the returned HTML response without applying output encoding or input validation. As a result, any JavaScript payload placed in IDRESERVA executes in the context of the Bookgy origin when a victim visits the crafted URL. Exploitation requires user interaction, typically delivered through phishing, malicious links, or third-party content injection.

Root Cause

The root cause is missing output encoding of user-controlled input before it is written into the HTML response body. The IDRESERVA parameter is treated as trusted data and inserted into the receipt template. HTML special characters such as <, >, and " are not escaped, allowing script tags and event handler attributes to break out of their intended context. The absence of a strong Content Security Policy (CSP) allows inline scripts to execute unimpeded.

Attack Vector

An attacker crafts a URL targeting /bkg_imprimir_comprobante.php with a JavaScript payload injected into the IDRESERVA parameter. The URL is delivered to an authenticated Bookgy user through email, chat, or a compromised web page. When the victim clicks the link, the payload executes in the origin of the Bookgy application. The attacker can then exfiltrate session cookies, capture form input, pivot to authenticated API calls, or redirect the user to attacker-controlled infrastructure. See the INCIBE Security Notice for coordinated disclosure details.

Detection Methods for CVE-2025-40616

Indicators of Compromise

HTTP requests to /bkg_imprimir_comprobante.php containing URL-encoded <script>, onerror=, onload=, or javascript: sequences in the IDRESERVA parameter.
Referrer headers pointing to external domains for requests targeting the bkg_imprimir_comprobante.php endpoint.
Web server access logs showing unusually long or non-numeric IDRESERVA values.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the IDRESERVA parameter for HTML tags, JavaScript keywords, and common XSS payload patterns.
Enable server-side logging of all query parameters submitted to bkg_imprimir_comprobante.php and alert on anomalous character classes.
Correlate outbound browser telemetry with inbound URL clicks to identify successful XSS-triggered exfiltration attempts.

Monitoring Recommendations

Monitor authentication events immediately following user access to reservation printout pages for signs of session hijacking.
Alert on Content Security Policy (CSP) violation reports referencing inline script execution on Bookgy pages.
Track outbound requests from browsers to unknown domains shortly after visits to the vulnerable endpoint.

How to Mitigate CVE-2025-40616

Immediate Actions Required

Contact the Bookgy vendor to obtain the latest patched release addressing the vulnerabilities disclosed in the INCIBE advisory.
Restrict access to /bkg_imprimir_comprobante.php at the WAF or reverse proxy layer until a fix is applied.
Educate users to avoid clicking Bookgy links received from untrusted sources.

Patch Information

At the time of publication, no fixed version identifier was listed in NVD. Bookgy customers should consult the INCIBE Security Notice and coordinate directly with the vendor to obtain remediation guidance. Apply vendor-supplied updates as soon as they are made available.

Workarounds

Enforce a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins.
Configure the reverse proxy or WAF to reject non-numeric values in the IDRESERVA parameter, matching the expected reservation identifier format.
Set the HttpOnly and Secure flags on session cookies to limit the impact of successful script execution.
Enable browser XSS protections and use SameSite cookie attributes to mitigate cross-site request abuse.

bash

# Example nginx rule to block non-numeric IDRESERVA values
location = /bkg_imprimir_comprobante.php {
    if ($arg_IDRESERVA !~ "^[0-9]+$") {
        return 400;
    }
    proxy_pass http://bookgy_backend;
}