CVE-2025-63949: Yohanawi Hotel Management System XSS Flaw

CVE-2025-63949 Overview

CVE-2025-63949 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Yohanawi Hotel Management System (commit 87e004a). The flaw resides in the error parameter of pages/room.php, which returns user-controlled input to the browser without proper output encoding. A remote, unauthenticated attacker can craft a malicious URL that, when opened by a victim, executes arbitrary JavaScript in the victim's browser session. The weakness maps to CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation enables session hijacking, credential theft via injected forms, and unauthorized actions performed in the context of the authenticated hotel management user.

Affected Products

Yohanawi Hotel Management System (commit 87e004a)
Yohanawi Hotel Management System build dated 2022-05-22
The vulnerable script pages/room.php accepting the error GET parameter

Discovery Timeline

2025-12-18 - CVE-2025-63949 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-63949

Vulnerability Analysis

The Yohanawi Hotel Management System reflects the value of the error query parameter directly into the HTML response generated by pages/room.php. Because the application does not apply HTML entity encoding or contextual output escaping, an attacker can embed JavaScript payloads inside the parameter value. When the crafted link is loaded by an authenticated staff or administrator user, the browser parses the injected markup and executes attacker-supplied script in the origin of the vulnerable application. This is a classic reflected XSS pattern requiring user interaction, typically delivered through phishing emails, malicious links on chat platforms, or hijacked referrer chains.

Root Cause

The root cause is missing input validation and missing output encoding for the error GET parameter. PHP concatenates the untrusted value into the response body without invoking htmlspecialchars() or an equivalent sanitizer. There is also no Content Security Policy (CSP) header configured to restrict inline script execution, so the browser has no defense-in-depth control that would block the injected payload.

Attack Vector

Exploitation is performed over the network and requires user interaction, as the victim must click or otherwise load the attacker's URL. Because the application is a hotel management back office, likely victims are receptionists, managers, or administrators with elevated privileges. Once script execution occurs, an attacker can steal session cookies, submit forged bookings, alter room data, or pivot to further attacks against the hosting server. The vulnerability does not require authentication to trigger, which broadens the pool of viable phishing scenarios. Refer to the GitHub Advisory for CVE-2025-63949 and the related Pending XSS advisory for proof-of-concept details.

Detection Methods for CVE-2025-63949

Indicators of Compromise

HTTP GET requests to pages/room.php containing script tags, event handlers (onerror=, onload=), or encoded payloads inside the error parameter
Web server access logs showing long, URL-encoded values in the error query string originating from external referrers
Unexpected outbound requests from client browsers to attacker-controlled domains immediately after loading room.php

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the error parameter for <script>, javascript:, and common event-handler patterns
Enable server-side logging of full request URIs and alert on hits to room.php containing angle brackets or %3C%73%63%72%69%70%74 sequences
Perform periodic dynamic application security testing (DAST) against the pages/ directory to catch reflected input in HTML responses

Monitoring Recommendations

Forward web server and reverse proxy logs to a centralized SIEM for correlation of phishing-delivered URLs with authenticated user sessions
Track anomalous session activity such as concurrent logins from disparate IP addresses following a suspected click on a crafted link
Monitor browser Content Security Policy violation reports if CSP is enforced in report-only mode

How to Mitigate CVE-2025-63949

Immediate Actions Required

Restrict public access to pages/room.php via network controls or authentication proxies until a fix is deployed
Apply a WAF virtual patch that blocks or sanitizes the error parameter for known XSS payloads
Train staff to avoid clicking unsolicited links referencing the hotel management application

Patch Information

No official vendor patch is listed in the NVD entry for the Yohanawi Hotel Management System at commit 87e004a. Operators should fork the repository, apply proper output encoding using htmlspecialchars($_GET['error'], ENT_QUOTES, 'UTF-8') before rendering the value, and validate the parameter against an allow-list of expected error codes. Review the advisory writeup for the specific injection point.

Workarounds

Add a strict Content Security Policy header such as Content-Security-Policy: default-src 'self'; script-src 'self' to prevent inline script execution
Set the HttpOnly and Secure flags on session cookies to limit the impact of successful script execution
Filter or drop requests to pages/room.php that include the error parameter at the reverse proxy layer

bash

# Example NGINX configuration to block XSS payloads in the error parameter
location /pages/room.php {
    if ($arg_error ~* "(<|%3C)[^>]*script|javascript:|onerror=|onload=") {
        return 403;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
    add_header X-XSS-Protection "1; mode=block" always;
}