Plateforme
php
Composant
cveee
Corrigé dans
1.0.1
A cross-site scripting (XSS) vulnerability has been identified in Complete Online Beauty Parlor Management System version 1.0. This flaw allows attackers to inject malicious scripts into the application via manipulation of the 'Name' parameter within the /admin/customer-list.php file. The vulnerability is remotely exploitable and a public proof-of-concept is available, posing a potential risk to administrators.
Successful exploitation of CVE-2025-13484 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to various malicious outcomes, including session hijacking, defacement of the administrative interface, and theft of sensitive information such as user credentials or customer data. Given the administrative context, an attacker could potentially gain control over the entire system, impacting all users and data stored within the beauty parlor management system. The availability of a public proof-of-concept significantly increases the likelihood of exploitation.
CVE-2025-13484 is a relatively low-severity vulnerability due to its XSS nature and the requirement for administrator access. However, the availability of a public proof-of-concept indicates a higher probability of exploitation, particularly if the system is publicly accessible and administrators are not diligent about security practices. The vulnerability was publicly disclosed on 2025-11-20.
Administrators of Complete Online Beauty Parlor Management System version 1.0 are at direct risk. Shared hosting environments where multiple users share the same server and application instance are particularly vulnerable, as a compromised administrator account could impact all tenants.
• php / web:
curl -s -X POST "http://<target>/admin/customer-list.php?Name=<script>alert('XSS')</script>" | grep "alert('XSS')"• generic web:
curl -s -X POST "http://<target>/admin/customer-list.php?Name=<script>alert('XSS')</script>" | grep "alert('XSS')"disclosure
Statut de l'Exploit
EPSS
0.06% (percentile 18%)
CISA SSVC
Vecteur CVSS
The primary mitigation for CVE-2025-13484 is to upgrade to a patched version of Complete Online Beauty Parlor Management System. As no fixed version is specified, immediate action is crucial. In the interim, implement a Web Application Firewall (WAF) rule to sanitize user input for the 'Name' parameter in /admin/customer-list.php, specifically filtering for potentially malicious JavaScript code. Additionally, review and restrict access to the /admin/customer-list.php endpoint to authorized administrators only. After implementing these mitigations, verify by attempting to inject a simple JavaScript payload (e.g., <script>alert('XSS')</script>) through the 'Name' parameter and confirming that it is properly blocked.
Actualizar a una versión parcheada del sistema de gestión de salones de belleza. Si no hay una versión disponible, sanitizar las entradas del usuario, especialmente el argumento 'Name' en el archivo /admin/customer-list.php, para prevenir la ejecución de código XSS. Contactar al proveedor para obtener un parche de seguridad.
Analyses de vulnérabilités et alertes critiques directement dans votre boîte mail.
CVE-2025-13484 is a cross-site scripting (XSS) vulnerability affecting Complete Online Beauty Parlor Management System version 1.0, allowing attackers to inject malicious scripts via the Name parameter in /admin/customer-list.php.
If you are running Complete Online Beauty Parlor Management System version 1.0, you are potentially affected by this vulnerability. Upgrade as soon as possible.
Upgrade to a patched version of Complete Online Beauty Parlor Management System. If upgrading is not immediately possible, implement a WAF rule to sanitize user input for the Name parameter.
While active exploitation is not confirmed, a public proof-of-concept exists, increasing the likelihood of exploitation.
Check the Campcodes website or relevant security forums for updates and advisories regarding CVE-2025-13484.
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.