CVE-2025-5974: Restaurant Table Booking System XSS Vulnerability

CVE-2025-5974 Overview

CVE-2025-5974 is a reflected cross-site scripting (XSS) vulnerability in PHPGurukul Restaurant Table Booking System 1.0. The flaw resides in the /check-status.php script, where the searchdata parameter is rendered back to the browser without proper output encoding. An attacker can craft a URL that injects arbitrary JavaScript into the response, executing in the context of a victim who follows the link. The issue is classified under CWE-79 and has been publicly disclosed, though no exploitation in the wild has been reported.

Critical Impact
Attackers can execute arbitrary JavaScript in the victim's browser session, enabling cookie theft, session hijacking, and phishing against users of the booking application.

Affected Products

PHPGurukul Restaurant Table Booking System 1.0
Deployments exposing /check-status.php to untrusted networks
Instances running unmodified PHPGurukul source code

Discovery Timeline

2025-06-10 - CVE-2025-5974 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5974

Vulnerability Analysis

The vulnerability is a reflected XSS in the status-check workflow of the booking application. When a user submits a search request to /check-status.php, the value supplied via the searchdata parameter is echoed back in the HTML response. Because the application does not sanitize or HTML-encode this input, script tags and event handlers are interpreted by the browser. Successful exploitation requires user interaction, typically clicking a crafted link, and executes with the privileges of the authenticated user session.

Root Cause

The underlying defect is missing output encoding on user-controlled input before it is embedded in the HTTP response. The application trusts the searchdata value as-is and inserts it into the rendered page. PHP applications must apply context-appropriate escaping such as htmlspecialchars() when reflecting input into HTML. The absence of this control fits the classic pattern described by CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation occurs over the network with low complexity and requires user interaction. An attacker constructs a URL pointing to /check-status.php with a JavaScript payload embedded in the searchdata query parameter. The target must click the link or be redirected to it. Once loaded, the browser executes the injected code in the origin of the vulnerable application, exposing cookies, DOM contents, and any actions the user can perform. See the GitHub CVE Issue Discussion and VulDB Entry #311852 for additional technical detail.

Detection Methods for CVE-2025-5974

Indicators of Compromise

HTTP requests to /check-status.php where the searchdata parameter contains <script, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E.
Web server access logs showing repeated probes of /check-status.php from a single source with varied payload structures.
Browser console errors or unexpected outbound requests originating from pages served by the booking application.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag XSS payload patterns targeting the searchdata parameter on /check-status.php.
Enable server-side logging of query strings and review for HTML tags or JavaScript URI schemes in user-supplied fields.
Use dynamic application security testing (DAST) tools to fuzz the searchdata parameter and confirm reflected output is unescaped.

Monitoring Recommendations

Alert on referrer values pointing to external domains that link into /check-status.php with query parameters containing script fragments.
Track spikes in 200-response traffic to the status-check endpoint with abnormally long query strings.
Correlate authenticated user sessions with suspicious outbound requests that may indicate cookie exfiltration.

How to Mitigate CVE-2025-5974

Immediate Actions Required

Restrict public access to /check-status.php through IP allowlists or authentication until the input handling is fixed.
Deploy a WAF rule blocking requests containing HTML or JavaScript syntax in the searchdata parameter.
Apply htmlspecialchars($input, ENT_QUOTES, 'UTF-8') to the searchdata value before echoing it in the response.

Patch Information

No official vendor patch has been published at the time of writing. Administrators should monitor the PHP Gurukul Blog for updates and review the VulDB Report #311852 for advisory status. If the application is deployed in production, consider migrating to a maintained alternative or applying custom source-code fixes based on the GitHub CVE Issue Discussion.

Workarounds

Add a Content Security Policy (CSP) header such as Content-Security-Policy: default-src 'self'; script-src 'self' to limit inline script execution.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of script-based cookie theft.
Sanitize the searchdata parameter at a reverse proxy layer by stripping angle brackets and event-handler attributes before the request reaches PHP.

bash

# Example ModSecurity rule to block XSS payloads on /check-status.php
SecRule REQUEST_URI "@beginsWith /check-status.php" \
    "chain,id:1005974,phase:2,deny,status:403,msg:'CVE-2025-5974 XSS attempt'"
    SecRule ARGS:searchdata "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:none,t:urlDecodeUni"