CVE-2025-5972: PHPGurukul Table Booking System XSS Flaw

CVE-2025-5972 Overview

CVE-2025-5972 is a cross-site scripting (XSS) vulnerability in PHPGurukul Restaurant Table Booking System 1.0. The flaw resides in the /admin/manage-subadmins.php script, where the fullname parameter is not properly sanitized before being rendered. An authenticated attacker with high privileges can inject arbitrary JavaScript that executes in the browser of any user viewing the affected admin page. The exploit has been publicly disclosed, and the vendor advisory indicates that other parameters in the same component may also be affected. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in administrator browsers, enabling session theft, admin impersonation, and modification of booking records.

Affected Products

PHPGurukul Restaurant Table Booking System 1.0
Component: /admin/manage-subadmins.php
Vulnerable parameter: fullname (other parameters may also be affected)

Discovery Timeline

2025-06-10 - CVE-2025-5972 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5972

Vulnerability Analysis

The vulnerability affects the sub-administrator management workflow of the PHPGurukul Restaurant Table Booking System. When an authenticated administrator submits data through manage-subadmins.php, the fullname field is stored and later reflected into the HTML response without output encoding. Any browser rendering the response will execute injected <script> payloads as if they originated from the trusted application. Because the payload persists in the application database, every subsequent visit to the admin page triggers the script, making this a stored XSS condition. The attacker needs valid high-privilege credentials to reach the vulnerable endpoint, which limits remote exploitation but does not eliminate it.

Root Cause

The root cause is missing input validation and missing output encoding on the fullname parameter in /admin/manage-subadmins.php. The application concatenates untrusted request data into HTML without applying htmlspecialchars() or an equivalent encoder. The disclosure notes that the sanitization gap likely extends to additional parameters within the same handler.

Attack Vector

An attacker who holds valid admin or sub-admin credentials submits a crafted fullname value containing JavaScript, for example a payload that calls document.location to exfiltrate session cookies. When another administrator opens the sub-administrator list, the browser parses the stored markup and executes the payload in the context of the application origin. The attacker can then hijack the targeted session, create additional backdoor accounts, or alter restaurant booking records. The attack is network-reachable but requires prior privileged access and user interaction, as reflected in the CVSS vector.

No verified proof-of-concept code is published. See the GitHub issue tracking CVE-2025-5972 and the VulDB entry #311850 for additional technical context.

Detection Methods for CVE-2025-5972

Indicators of Compromise

Entries in the sub-admin database table where the fullname column contains HTML tags such as <script>, <img, onerror=, or javascript: URI schemes.
Web server access logs showing POST requests to /admin/manage-subadmins.php with encoded script payloads in the fullname parameter.
Unexpected outbound requests from admin workstations to attacker-controlled domains shortly after rendering the sub-admin management page.
Creation of new sub-administrator accounts or privilege changes that were not initiated by legitimate operators.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects POST bodies to /admin/*.php for XSS signatures and blocks requests containing HTML or JavaScript syntax in text fields.
Query the application database for stored values matching XSS indicators, focusing on the fullname column and other free-text fields in sub-admin records.
Enable Content Security Policy (CSP) violation reporting to surface inline script execution on admin pages.

Monitoring Recommendations

Audit administrator session activity for unusual IP addresses, concurrent sessions, or token reuse that could indicate cookie theft.
Monitor server logs for requests to manage-subadmins.php from accounts that do not normally administer sub-admin records.
Alert on any modification to the sub-admin table outside of approved change windows.

How to Mitigate CVE-2025-5972

Immediate Actions Required

Restrict access to /admin/manage-subadmins.php to a controlled IP allowlist until a patched build is available.
Rotate all administrator and sub-administrator credentials, and invalidate active session tokens.
Review the sub-admin table and remove any records containing HTML or JavaScript markup in the fullname field.
Enforce multi-factor authentication on all administrative accounts to reduce the value of hijacked sessions.

Patch Information

No vendor patch is listed in the NVD or VulDB references at the time of publication. Operators should monitor PHPGurukul for updated builds. Until a fix ships, apply the server-side input encoding and WAF controls described below. The disclosure is tracked in VulDB CTI #311850 and VulDB submission #592340.

Workarounds

Add server-side sanitization that wraps every write to the sub-admin table in htmlspecialchars($value, ENT_QUOTES, 'UTF-8') or an equivalent encoder, and apply the same encoding on output.
Deploy a strict Content Security Policy such as default-src 'self'; script-src 'self' on admin routes to block inline script execution.
Set the HttpOnly and Secure flags on session cookies, and add SameSite=Strict to limit cross-site reuse of stolen tokens.
Place the admin interface behind a VPN or reverse proxy that enforces strong authentication before requests reach the vulnerable PHP handler.

bash

# Example WAF rule (ModSecurity) to block script payloads in the fullname parameter
SecRule ARGS:fullname "@rx (?i)(<script|onerror=|javascript:|<img[^>]+src)" \
    "id:1005972,phase:2,deny,status:403,log,\
     msg:'CVE-2025-5972 XSS attempt in manage-subadmins.php fullname'"