CVE-2025-7142: Mayurik Salon Management System XSS Flaw

CVE-2025-7142 Overview

CVE-2025-7142 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Best Salon Management System 1.0. The flaw resides in the /panel/search-appointment.php component, where user-supplied input is rendered back to the browser without proper output encoding. An authenticated attacker can inject arbitrary JavaScript that executes in the context of another user's session. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed installations. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary script in a victim's browser session, enabling session data theft, UI manipulation, and phishing within the salon management panel.

Affected Products

Mayurik Best Salon Management System 1.0
Component: /panel/search-appointment.php
CPE: cpe:2.3:a:mayurik:best_salon_management_system:1.0:*:*:*:*:*:*:*

Discovery Timeline

2025-07-07 - CVE-2025-7142 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7142

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the appointment search functionality of the administrative panel. The search-appointment.php script accepts user-controlled input and echoes it back into the HTML response without sanitization or contextual encoding. As a result, an attacker can craft a URL or form submission containing JavaScript payloads that execute when a privileged user views the response.

Exploitation requires an authenticated session with elevated privileges and user interaction, such as clicking a crafted link. The attack is network-reachable and does not require local access. Because the payload executes within the origin of the salon management application, it can access cookies, tokens, and DOM content available to the victim.

The underlying weakness is classified as [CWE-79]. The application lacks input validation on the search parameters and omits output encoding when rendering the search results page.

Root Cause

The root cause is missing output encoding on user-controllable parameters passed to /panel/search-appointment.php. The PHP script concatenates request data directly into the HTML response, allowing <script> tags and event-handler attributes to be interpreted by the browser. No Content Security Policy is enforced to mitigate script execution.

Attack Vector

An attacker crafts a URL containing a malicious payload in a parameter processed by the appointment search endpoint. The attacker delivers the link to an authenticated staff or administrator user through phishing or a chat channel. When the target loads the URL in an active session, the injected script executes, enabling session manipulation, credential harvesting via fake forms, or unauthorized actions within the panel. Refer to the public GitHub XSS Vulnerability Analysis for proof-of-concept details.

Detection Methods for CVE-2025-7142

Indicators of Compromise

Web server access logs containing requests to /panel/search-appointment.php with <script>, onerror=, javascript:, or URL-encoded equivalents in query parameters.
Unexpected outbound requests from browsers of authenticated panel users to attacker-controlled domains shortly after visiting the search endpoint.
Session tokens or cookies appearing in referer headers or third-party log aggregators.

Detection Strategies

Deploy a web application firewall rule that inspects query strings and POST bodies to /panel/search-appointment.php for common XSS signatures.
Enable HTTP request logging with full URI capture and review entries for reflected input patterns.
Correlate authenticated user activity with anomalous JavaScript execution or DOM changes via browser telemetry.

Monitoring Recommendations

Alert on referer headers to the salon management panel originating from external chat platforms, webmail, or shortened URLs.
Monitor for unusual API calls or administrative actions occurring immediately after a search-appointment request.
Track browser console errors and CSP violation reports if a Content Security Policy is deployed.

How to Mitigate CVE-2025-7142

Immediate Actions Required

Restrict access to the /panel/ directory to trusted IP ranges via web server configuration until a patch is available.
Require administrators to log out of the panel before browsing external links and enforce short session lifetimes.
Deploy WAF rules that block requests to search-appointment.php containing HTML tags or JavaScript event handlers in parameters.

Patch Information

No vendor patch is currently referenced in the NVD entry for CVE-2025-7142. Users of Mayurik Best Salon Management System 1.0 should monitor SourceCodester Security Resources for updates and consider migrating away from the affected version. Additional tracking is available at VulDB #315056.

Workarounds

Apply server-side input validation and HTML-context output encoding on all parameters processed by /panel/search-appointment.php before rendering.
Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and SameSite=Strict attributes on session cookies to reduce the impact of script execution.
Consider taking the application offline or isolating it behind a VPN until code-level remediation is completed.

bash

# Example Apache configuration to restrict panel access and add security headers
<Location "/panel/">
    Require ip 192.0.2.0/24
</Location>

Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'"
Header always set X-XSS-Protection "1; mode=block"
Header always set X-Content-Type-Options "nosniff"
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure;SameSite=Strict