PT-2025-18071 · Unknown · Codeastro Bus Ticket Booking System

Arunmodi · Published 2025-04-28 · Updated 2025-04-28 · CVE-2025-25776

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Codeastro Bus Ticket Booking System version 1.0

Description A Cross-Site Scripting (XSS) issue exists in the User Registration and User Profile features, allowing an attacker to execute arbitrary code in the Full Name and Address fields during user registration or profile editing.

Recommendations For Codeastro Bus Ticket Booking System version 1.0, consider disabling the User Registration and User Profile editing features until a patch is available to prevent exploitation of the XSS issue. Restrict access to the Full Name and Address fields to minimize the risk of arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-25776

Affected Products

Codeastro Bus Ticket Booking System

References · 6

• 🔥 https://github.com/arunmodi/Vulnerability-Research/tree/main/CVE-2025-25776 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-25776 · Security Note
• https://osv.dev/vulnerability/CVE-2025-25776 · Vendor Advisory
• https://codeastro.com/bus-ticket-booking-system-in-php-codeigniter-with-source-code · Note
• https://twitter.com/CVEnew/status/1916865722367836606 · Twitter Post
• https://t.me/cvetracker/22533 · Telegram Post