CVE-2025-8380: Online Hotel Reservation System XSS Flaw

CVE-2025-8380 Overview

CVE-2025-8380 is a reflected cross-site scripting (XSS) vulnerability in Campcodes Online Hotel Reservation System 1.0. The flaw exists in the /admin/add_query_account.php script, where the Name parameter is processed without proper output encoding. An authenticated attacker can inject script payloads that execute in the browser context of an administrator viewing the affected page. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed deployments.

Critical Impact
Successful exploitation enables session riding, administrative action forgery, and credential theft against the hotel reservation system's admin console.

Affected Products

Campcodes Online Hotel Reservation System 1.0
Deployments using the vulnerable /admin/add_query_account.php endpoint
Any downstream forks that reuse the unpatched account query handler

Discovery Timeline

2025-07-31 - CVE-2025-8380 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8380

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting issue [CWE-79] in the administrative account query functionality. The Name argument submitted to /admin/add_query_account.php is rendered back into the HTML response without proper sanitization or contextual output encoding. When an administrator loads the resulting page, injected JavaScript executes under the application's origin.

Exploitation requires network access to the application and low-privileged authentication, with user interaction needed to trigger the payload. The impact is limited to integrity of client-side content rendered by the admin interface, with no direct effect on confidentiality or availability of the underlying system.

Root Cause

The root cause is missing input validation and output encoding on the Name request parameter. The handler accepts attacker-controlled input and reflects it into HTML without escaping characters such as <, >, ", and '. Modern mitigations such as Content Security Policy (CSP) and templating with auto-escaping are also absent from the affected PHP code path.

Attack Vector

An attacker crafts a URL or form submission that places a JavaScript payload into the Name parameter of /admin/add_query_account.php. The payload is delivered to a logged-in administrator via phishing or an attacker-controlled page. When the administrator submits or views the resulting content, the script runs in the admin's browser session, allowing cookie theft, forged administrative requests, or injected UI overlays.

No verified proof-of-concept code is published in the referenced advisories beyond the GitHub Issue Discussion and the VulDB entry. Refer to those sources for parameter-level details.

Detection Methods for CVE-2025-8380

Indicators of Compromise

HTTP requests to /admin/add_query_account.php containing Name parameter values with <script>, onerror=, javascript:, or encoded variants such as %3Cscript%3E.
Admin session cookies observed in outbound traffic to untrusted hosts shortly after visits to the account query page.
Unexpected admin account creations or query records authored by legitimate administrator sessions.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect Name and similar fields on /admin/* endpoints for XSS signatures.
Enable verbose web server logging for the admin directory and alert on reflected payload patterns in query strings and POST bodies.
Correlate admin authentication events with anomalous POSTs to add_query_account.php to identify forged administrative actions.

Monitoring Recommendations

Monitor browser-side CSP violation reports if a report-only policy is deployed in front of the admin console.
Track user-agent and source-IP diversity for admin sessions to surface session hijacking stemming from stolen cookies.
Review PHP access logs daily for malformed or script-bearing Name values until a vendor patch is applied.

How to Mitigate CVE-2025-8380

Immediate Actions Required

Restrict network access to /admin/ to trusted management IP ranges using firewall or reverse-proxy rules.
Enforce short admin session lifetimes and require re-authentication for sensitive account operations.
Set the HttpOnly and Secure flags on all admin session cookies to blunt cookie theft via XSS.
Instruct administrators to avoid clicking untrusted links while authenticated to the reservation system.

Patch Information

No vendor advisory or official patch has been published for Campcodes Online Hotel Reservation System 1.0 at the time of writing. Review the CampCodes Blog and the VulDB CTI entry for update notices. Operators maintaining their own fork should sanitize the Name parameter with htmlspecialchars($Name, ENT_QUOTES, 'UTF-8') before echoing it into any HTML context.

Workarounds

Place a reverse proxy or WAF in front of the application with signatures for reflected XSS targeting the Name parameter.
Add a strict Content-Security-Policy response header on /admin/* to block inline script execution.
Disable or firewall-off the add_query_account.php endpoint if the query account feature is unused.

bash

# Example nginx configuration to restrict and harden the admin path
location /admin/ {
    allow 10.0.0.0/8;
    deny all;

    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header Referrer-Policy "no-referrer" always;

    proxy_pass http://127.0.0.1:8080;
}