CVE-2025-5177: Queue Ticket Kiosk XSS Vulnerability

CVE-2025-5177 Overview

CVE-2025-5177 is a cross-site scripting (XSS) vulnerability [CWE-79] in Realce Tecnologia Queue Ticket Kiosk versions up to 20250517. The flaw resides in the Admin Login Page at /adm/index.php, where the Usuário (username) parameter is not properly sanitized. Remote attackers can inject arbitrary script content that executes in the context of a victim's browser when the crafted input is rendered.

The vendor was contacted before public disclosure but did not respond. No patch is currently listed in the advisory data.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in an administrator's browser, potentially enabling session theft, credential harvesting, or unauthorized actions against the queue management system.

Affected Products

Realce Tecnologia Queue Ticket Kiosk versions up to and including 20250517
Component: Admin Login Page (/adm/index.php)
Affected parameter: Usuário

Discovery Timeline

2025-05-26 - CVE-2025-5177 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5177

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw affecting the administrative login interface of Queue Ticket Kiosk. The application processes user-supplied input from the Usuário field on /adm/index.php without applying output encoding or input sanitization before rendering it back in the HTTP response.

An attacker can craft a URL or form submission containing JavaScript payloads in the Usuário parameter. When an administrator or victim opens the crafted request, the injected script executes within the trust context of the Queue Ticket Kiosk web application. User interaction is required, as reflected in the CVSS 4.0 vector (UI:P).

The EPSS probability is approximately 0.48% (38th percentile), indicating a low observed exploitation likelihood in the near term. However, the low attack complexity and lack of authentication requirements make opportunistic abuse feasible.

Root Cause

The root cause is missing input validation and output encoding on the Usuário argument handled by /adm/index.php. User-controlled input flows directly into an HTML response context, allowing script tags and event handlers to be interpreted by the browser [CWE-79].

Attack Vector

The attack is delivered over the network. An attacker crafts a malicious link or web form containing an XSS payload targeting the Usuário parameter, then delivers it to an administrator via phishing, chat, or a compromised website. When the target loads the request, the payload executes in their browser session against the kiosk admin interface.

No verified proof-of-concept code has been released. The vulnerability mechanism is documented in the VulDB CTI Entry #310265 and VulDB Submission #579850.

Detection Methods for CVE-2025-5177

Indicators of Compromise

HTTP requests to /adm/index.php containing script-like tokens such as <script, onerror=, onload=, or javascript: in the Usuário parameter.
URL-encoded XSS payloads targeting the login form (e.g., %3Cscript%3E, %22%3E%3Cimg).
Unexpected outbound requests from administrator browsers to attacker-controlled domains following visits to the admin login page.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST and GET parameters submitted to /adm/index.php for XSS patterns.
Enable web server access logging and alert on requests containing HTML or JavaScript syntax within the Usuário field.
Correlate suspicious login-page requests with subsequent anomalous administrator session activity.

Monitoring Recommendations

Monitor referrer headers and user-agent patterns targeting the kiosk admin interface for automated scanning.
Track browser telemetry for administrators accessing /adm/index.php from untrusted links or external referrers.
Review web server logs for repeated failed logins containing malformed or oversized Usuário values.

How to Mitigate CVE-2025-5177

Immediate Actions Required

Restrict network access to the /adm/ administrative path so that it is reachable only from trusted management networks or via VPN.
Instruct administrators to avoid clicking untrusted links pointing to the Queue Ticket Kiosk admin login.
Deploy a WAF or reverse-proxy filter to block HTML and JavaScript metacharacters submitted to /adm/index.php.

Patch Information

At the time of publication, the vendor Realce Tecnologia has not released an official patch or advisory. The vendor did not respond to disclosure attempts referenced in the VulDB entry. Operators should monitor vendor communications for a fixed release beyond version 20250517.

Workarounds

Place the admin interface behind an authenticating reverse proxy with strict input filtering.
Enforce a strong Content-Security-Policy (CSP) header on the kiosk web application to limit inline script execution.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of successful script injection.
Consider isolating the kiosk web application on a dedicated network segment until a vendor fix is available.

bash

# Example nginx configuration to restrict /adm/ and add CSP
location /adm/ {
    allow 10.0.0.0/8;
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    proxy_pass http://kiosk_backend;
}