CVE-2025-0538 Details
Description
A vulnerability, which was classified as problematic, was found in code-projects Tourism Management System 1.0. Affected is an unknown function of the file /admin/manage-pages.php. The manipulation of the argument pgedetails leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
A stored cross-site scripting vulnerability has been identified in Code-Projects Tourism Management System version 1.0. The issue arises in the file '/admin/manage-pages.php', where the 'pgedetails' parameter is not properly sanitized, allowing attackers to inject malicious JavaScript. This injected script is executed when the affected page is viewed, potentially leading to the theft of sensitive information such as cookies and session tokens, and allowing attackers to perform actions on behalf of other users.
To address this vulnerability, sanitize output using functions like 'htmlentities()' or 'htmlspecialchars()' with 'ENT_QUOTES' to encode HTML special characters. Validate and sanitize user input on both client-side and server-side to reject malicious scripts. Implement a Content Security Policy to mitigate the impact of potential XSS attacks.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 17, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://code-projects.org/ | [email protected] | Product |
| https://github.com/aaryan-11-x/My-CVEs/blob/main/CVE-2025-0538.md | [email protected] | ExploitThird Party Advisory |
| https://vuldb.com/?ctiid.292422 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.292422 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.479895 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fabian tourism management system | 1.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2025 | CPE Deprecation Remap | [email protected] |
| Feb 21, 2025 | Initial Analysis | [email protected] |
| Jan 18, 2025 | CVE Modified | [email protected] |
| Jan 17, 2025 | New CVE Received | [email protected] |