CVE-2025-5973: Restaurant Table Booking System XSS Flaw

CVE-2025-5973 Overview

CVE-2025-5973 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in PHPGurukul Restaurant Table Booking System 1.0. The flaw resides in the /admin/add-table.php endpoint, where the tableno parameter is rendered without proper output encoding. An authenticated administrator who submits or is tricked into submitting a crafted value can trigger execution of attacker-controlled script in the browser session. The issue was publicly disclosed and indexed in VulDB entry 311851. Exploitation requires high privileges and user interaction, which limits the practical impact.

Critical Impact
Attackers who coerce an authenticated administrator into visiting a crafted request can execute JavaScript in the admin's browser context, enabling session abuse within the admin panel.

Affected Products

PHPGurukul Restaurant Table Booking System 1.0
Component: /admin/add-table.php
Parameter: tableno

Discovery Timeline

2025-06-10 - CVE-2025-5973 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5973

Vulnerability Analysis

The vulnerability is a stored or reflected XSS condition in the administrative table management page of the booking application. When an administrator submits the tableno field through /admin/add-table.php, the application places the value back into the response HTML without applying contextual output encoding. A payload containing HTML or JavaScript executes in the admin's browser when the response is rendered.

Exploitation requires an authenticated administrator session, so remote unauthenticated abuse is not possible. The attacker must either control a privileged account or trick a logged-in administrator into submitting the malicious value through social engineering or a cross-site request.

The impact is confined to the integrity of content rendered inside the admin interface. Attackers can modify page content, hijack administrative actions, or pivot to credential theft within the admin panel.

Root Cause

The root cause is missing input sanitization and missing output encoding on the tableno parameter in /admin/add-table.php. The application fails to apply HTML entity encoding when echoing user-supplied data back into the response, which allows raw <script> tags and HTML event handlers to be interpreted by the browser.

Attack Vector

The attack is network-based and targets authenticated administrators of the booking system. An attacker crafts a request to /admin/add-table.php containing a JavaScript payload inside the tableno parameter. When an administrator submits the form or follows a crafted link, the payload executes in the context of the admin session. Public disclosure of the technique is available via the GitHub CVE Issue Discussion and VulDB #311851.

No verified proof-of-concept code is reproduced here. Technical details are available in the referenced advisories.

Detection Methods for CVE-2025-5973

Indicators of Compromise

HTTP POST or GET requests to /admin/add-table.php containing <script, onerror=, onload=, or URL-encoded equivalents (%3Cscript) in the tableno parameter.
Admin session activity originating from unusual IP addresses shortly after a tableno submission containing HTML metacharacters.
Browser console errors or outbound requests from the admin panel to attacker-controlled domains.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects the tableno parameter for HTML tags, event handlers, and encoded script delimiters.
Enable web server access logging and alert on requests to /admin/add-table.php where the request body contains angle brackets or javascript: schemes.
Review admin audit logs for table entries whose names contain markup that would not appear in legitimate use.

Monitoring Recommendations

Monitor outbound HTTP connections from administrator workstations for traffic to unexpected domains following admin panel use.
Centralize PHP application logs and web server logs for correlation of input anomalies with session activity.
Track creation and modification of records in the tbltable database table for suspicious values.

How to Mitigate CVE-2025-5973

Immediate Actions Required

Restrict access to /admin/ to trusted administrator IP ranges or require VPN access to the admin panel.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts in the admin interface.
Require administrators to use isolated browser profiles for application administration.
Audit existing database records for tableno values containing HTML or JavaScript payloads.

Patch Information

No vendor patch is listed in the referenced advisories. Consult the PHP Gurukul Blog for vendor updates. Operators should apply source-level fixes by sanitizing input with htmlspecialchars($tableno, ENT_QUOTES, 'UTF-8') before echoing the value, and by validating that tableno contains only expected characters such as digits or short alphanumeric identifiers.

Workarounds

Add server-side input validation that rejects any tableno value containing non-alphanumeric characters.
Apply contextual output encoding on all admin templates that render user-supplied form fields.
Deploy a WAF rule blocking requests to /admin/add-table.php where parameters contain <, >, or javascript: tokens.
Enable the HttpOnly and Secure flags on admin session cookies to reduce the value of script-based session theft.

bash

# Example ModSecurity rule to block script-like payloads in tableno
SecRule ARGS:tableno "@rx (?i)(<script|onerror=|onload=|javascript:)" \
  "id:1005973,phase:2,deny,status:403,log,\
   msg:'CVE-2025-5973 XSS attempt in tableno parameter'"