Campcodes Park Ticketing System admin_class.php save_pricing cross site scripting

Successful exploitation of CVE-2025-15214 enables an attacker to inject arbitrary JavaScript code into the Park Ticketing System. This code can then be executed in the context of a user's browser when they interact with the affected page. The impact ranges from session hijacking and defacement to the theft of sensitive user data, such as login credentials or personal information. Because the vulnerability is remotely exploitable, attackers can target users without requiring local access to the system. The public availability of an exploit significantly increases the risk of widespread exploitation.

Administrators and users of Campcodes Park Ticketing System version 1.0 are at risk. Shared hosting environments where multiple users share the same server instance are particularly vulnerable, as an attacker could potentially compromise other users' accounts through this XSS vulnerability.

• generic web: Use curl to test the admin_class.php endpoint with crafted payloads containing <script>alert(1)</script> in the name or ride parameters. Monitor access logs for suspicious requests containing similar patterns.

curl 'http://example.com/admin_class.php?name=<script>alert(1)</script>&ride=test'

• php: Examine the adminclass.php file for the savepricing function. Look for missing or inadequate input validation and output encoding of the name and ride parameters. Review the application's overall security configuration for potential weaknesses.

1. 2025-12-30Disclosure

   disclosure

1. Reserviert2025-12-28
2. Veröffentlicht2025-12-30
3. Geändert2026-02-24
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-15214 is to upgrade to a patched version of Campcodes Park Ticketing System as soon as it becomes available. Until a patch is applied, consider implementing input validation and output encoding on the name and ride parameters within the save_pricing function to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Regularly review and update security configurations to minimize the attack surface.