Campcodes Park Ticketing System CVE-2025-15214

Exploitation requires the attacker to possess high-level administrative privileges (PR:H) within the Campcodes Park Ticketing System - specifically, the ability to access the save_pricing function in admin_class.php. The victim must be an authenticated administrator, and the attack depends on user interaction (UI:P), meaning the victim administrator must actively click or navigate to a crafted URL containing the XSS payload. The vulnerability is triggered only when unsanitized input from the name/ride parameter is processed by the save_pricing function without HTML encoding or validation. Default configurations are vulnerable if no additional input sanitization is implemented at the web server or application firewall level. Authentication cannot be bypassed; this is strictly an admin-to-admin or insider attack vector.

This vulnerability presents minimal real-world risk despite public exploit availability. The CVSS 4.0 score of 1.9 reflects the high barrier to exploitation: PR:H (high-privilege requirement) means only administrators can trigger it, and UI:P (user interaction required) means a victim must click a crafted link. EPSS at 0.02% (6th percentile) indicates extremely low probability of automated exploitation. The impact is limited to integrity of victim sessions (VI:L - low integrity impact) with no confidentiality or availability concerns. While POC exists, the confluence of high privilege requirement, user interaction dependency, and low impact severity suggests this is a low-priority vulnerability suitable for standard patching cycles rather than emergency response. The primary risk is to users already logged in as administrators who might be socially engineered into clicking malicious links crafted by other administrators or insiders.

An authenticated administrator with write permissions to pricing functions crafts a malicious link containing XSS payload in the name/ride parameter (e.g., /admin_class.php?action=save_pricing&ride=<script>alert('XSS')</script>) and tricks another administrator into clicking it via email or chat. When the victim administrator's browser processes the response, the injected script executes in their session context, potentially stealing session cookies or modifying pricing data.