CVE-2025-5970: Restaurant Table Booking System XSS Flaw

CVE-2025-5970 Overview

CVE-2025-5970 is a stored cross-site scripting (XSS) vulnerability in PHPGurukul Restaurant Table Booking System version 1.0. The flaw resides in the /admin/add-subadmin.php script, where the fullname parameter is not properly sanitized before being rendered. An authenticated administrator can inject arbitrary JavaScript that executes in the browser of any user viewing affected pages. The vulnerability is classified under CWE-79 and can be exploited remotely across the network. Public disclosure has occurred, and other parameters within the same endpoint may exhibit similar behavior.

Critical Impact
Attackers with administrative access can inject persistent JavaScript through the fullname parameter, enabling session theft, credential harvesting, or unauthorized actions against other users of the booking system.

Affected Products

PHPGurukul Restaurant Table Booking System 1.0
Component: /admin/add-subadmin.php
CPE: cpe:2.3:a:phpgurukul:restaurant_table_booking_system:1.0:*:*:*:*:*:*:*

Discovery Timeline

2025-06-10 - CVE-2025-5970 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5970

Vulnerability Analysis

The vulnerability affects the sub-administrator creation workflow inside the PHP-based restaurant booking application. The add-subadmin.php script accepts the fullname form field and stores it without applying output encoding or input filtering. When the stored value is later reflected in administrative views, the browser interprets the payload as executable script content.

Because the injected content persists in the application database, every user who loads the affected view triggers the script. The attacker does not need to lure victims to a crafted URL. Exploitation requires high privileges since the endpoint is behind the administrative login, and the CVSS 4.0 vector indicates limited integrity impact with no direct effect on confidentiality or availability.

Root Cause

The root cause is missing input validation and output encoding on the fullname parameter in /admin/add-subadmin.php. The application concatenates user-supplied strings into HTML contexts without escaping characters such as <, >, and ". This design flaw maps to [CWE-79]: Improper Neutralization of Input During Web Page Generation.

Attack Vector

An authenticated administrator submits a crafted fullname value containing HTML or JavaScript through the sub-admin creation form. The payload is stored in the backend database and served to any user who views the sub-admin listing or related administrative pages. The vendor advisory notes that additional parameters on the same page may share the same weakness. See the GitHub CVE Issue Discussion and VulDB ID #311846 for public technical details.

// Example exploitation code (sanitized)
// No verified proof-of-concept is included. Refer to the linked VulDB and GitHub
// disclosure entries for the public technical description of the fullname payload.

Detection Methods for CVE-2025-5970

Indicators of Compromise

POST requests to /admin/add-subadmin.php containing HTML tags, <script> blocks, or javascript: URIs inside the fullname field.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after loading sub-admin management pages.
Newly created sub-admin records whose fullname values contain angle brackets, event handlers such as onerror=, or encoded script fragments.

Detection Strategies

Inspect web server access logs for POST bodies to add-subadmin.php that include reserved HTML characters in the fullname parameter.
Deploy web application firewall rules that flag XSS signatures on administrative form submissions in PHPGurukul applications.
Query the application database for stored sub-admin names containing markup or scripting syntax and treat matches as suspicious.

Monitoring Recommendations

Enable audit logging on administrative account creation and review sub-admin activity on a recurring cadence.
Correlate administrator session anomalies, such as unusual outbound traffic, with recent visits to sub-admin pages.
Monitor Content Security Policy (CSP) violation reports if a policy is deployed, since inline script execution attempts will surface as violations.

How to Mitigate CVE-2025-5970

Immediate Actions Required

Restrict access to /admin/ paths to trusted IP ranges or VPN users until a fix is applied.
Audit existing sub-admin records and purge entries containing HTML or JavaScript in the fullname field.
Rotate credentials for any administrator accounts that accessed affected pages after the disclosure date.

Patch Information

No vendor patch has been published in the referenced advisories at the time of writing. Track updates through the PHP Gurukul Resource Site and the VulDB CTI ID #311846 record. Until an official release is available, apply the workarounds below.

Workarounds

Add server-side input validation to add-subadmin.php that rejects or strips HTML metacharacters from fullname and related fields.
Apply context-appropriate output encoding, for example htmlspecialchars($value, ENT_QUOTES, 'UTF-8'), wherever sub-admin data is rendered.
Deploy a Content Security Policy that disallows inline scripts to reduce the impact of any residual injection.
Place the application behind a web application firewall configured with XSS rule sets targeting administrative endpoints.

bash

# Configuration example
# Example PHP output-encoding pattern applied when rendering stored sub-admin data
# echo htmlspecialchars($row['fullname'], ENT_QUOTES | ENT_HTML5, 'UTF-8');

# Example Apache rule to restrict admin access by source IP
# <Location "/admin/">
#   Require ip 10.0.0.0/8
# </Location>