Hi,
I had never used the MSSP module in slave mode Before but I just had a play with two 18F25K20 devices, one as master and one as slave.
The master sends the letters "A" to "Z" and outputs both what it sends and what it recieves to the serial terminal.
The slave responds with the letters "Z" to "A". It outputs what it receives and what it sends to the serial terminal.

At this time I did not have time to implement and test the SS-line but apart from that it appears to work as expected.

You might be able to gain some insight into your trouble by looking at these two programs.

Here's the code for the master:
Code:
'****************************************************************
'*  Name    : SPI Master.pbp                                    *
'*  Author  : Henrik Olsson                                     *
'*  Notice  : Copyright (c) 2013 [Henrik Olsson]                *
'*          : All Rights Reserved                               *
'*  Date    : 2013-11-12                                        *
'*  Version : 1.0                                               *
'*  Notes   : Designed to run on 18F45K20, AMICUS18 platform.   *
'*          :                                                   *
'****************************************************************
DEFINE OSC 64                       ' Default oscillator speed on the AMICUS18 is 16*4MHz
DEFINE LOADER_USED 1                ' We're using a bootloader.

DEFINE HSER_RCSTA 90h               ' Enable serial port & continuous receive
DEFINE HSER_TXSTA 24h               ' Enable transmit, BRGH = 1
DEFINE HSER_CLROERR 1               ' Clear overflow automatically
DEFINE HSER_SPBRG 138               ' 115200 Baud @ 64MHz, -0,08%

SPBRGH = 0
BAUDCON.3 = 1                       ' Enable 16 bit baudrate generator

TRISC = %10010110                   ' RX, TX, SDO, SDI, SCK, N/U, N/U, CS 
TRISB = %11111111                   ' N/U, N/U, N/U, N/U, N/U, N/U, N/U, N/U

' Aliases for the MSSP module status and control bits.
SSPEN           VAR SSPCON1.5       ' SSP Enable bit  
CKP             VAR SSPCON1.4       ' Clock Polarity Select  
SMP             VAR SSPSTAT.7       ' Data input sample phase  
CKE             VAR SSPSTAT.6       ' Clock Edge Select bit
BF              VAR SSPSTAT.0       ' Buffer full flag.  

' Set up the MSSP module.
CKP = 0                             ' Clock idles low  
CKE = 0                             ' Transmit on idle to active transition.  
SMP = 0                             ' Sample in middle of data 
SSPEN = 1                           ' Enable SPI pins
SSPCON1.0 = 1                       ' Slow down SPI clock to Fosc/16 for now.

i VAR BYTE
Response VAR BYTE

Response = SSPBUF                       ' Dummy read to buffer and BF-flag
    
HSEROUT ["Master start...", 13]
HSEROUT ["TX - RX",13]
Pause 5000

Main:
    For i = "A" to "Z"                  ' Send letters A to Z
        SSPBUF = i                      ' Load buffer with content
        While BF = 0 : WEND             ' Wait for operation to complete
        Response = SSPBUF               ' Read response
        HSEROUT [i, "  -  ", Response, 13]
        PAUSE 10
    NEXT
    
    HSEROUT ["Done.....", 13]

    Pause 5000

Goto Main
And here's the code for the slave:
Code:
'****************************************************************
'*  Name    : SPI Slave.pbp                                     *
'*  Author  : Henrik Olsson                                     *
'*  Notice  : Copyright (c) 2013 [Henrik Olsson]                *
'*          : All Rights Reserved                               *
'*  Date    : 2013-11-12                                        *
'*  Version : 1.0                                               *
'*  Notes   : Designed to run on 18F45K20, AMICUS18 platform.   *
'*          :                                                   *
'****************************************************************
DEFINE OSC 64                       ' Default oscillator speed on the AMICUS18 is 16*4MHz
DEFINE LOADER_USED 1                ' We're using a bootloader.

DEFINE HSER_RCSTA 90h               ' Enable serial port & continuous receive
DEFINE HSER_TXSTA 24h               ' Enable transmit, BRGH = 1
DEFINE HSER_CLROERR 1               ' Clear overflow automatically
DEFINE HSER_SPBRG 138               ' 115200 Baud @ 64MHz, -0,08%

SPBRGH = 0
BAUDCON.3 = 1                       ' Enable 16 bit baudrate generator

TRISC = %10011111                   ' RX, TX, SDO, SDI, SCK, N/U, N/U, CS 
TRISB = %11111111                   ' N/U, N/U, N/U, N/U, N/U, N/U, N/U, N/U

' Aliases for the MSSP module status and control bits.
SSPEN           VAR SSPCON1.5       ' SSP Enable bit  
CKP             VAR SSPCON1.4       ' Clock Polarity Select  

SMP             VAR SSPSTAT.7       ' Data input sample phase  
CKE             VAR SSPSTAT.6       ' Clock Edge Select bit  
BF              VAR SSPSTAT.0       ' Buffer Full bit

' Set up the MSSP module.
CKP = 0                             ' Clock idles low  
CKE = 0                             ' Transmit on idle to active transition.  
SMP = 0                             ' Sample in middle of data 

While PortC.4 = 1 : WEND            ' Wait for SCK pin to be idle before enabling MSSP
SSPCON1 = %00100101                 ' Slave mode, no SS

i VAR BYTE
Response VAR BYTE

HSEROUT ["Slave start...", 13]
HSEROUT ["RX - TX", 13]

Main:
    For i = "Z" to "A" STEP -1
        SSPBUF = i                      ' Load buffer
        While BF = 0 : WEND             ' Wait for data to arrive
        Response = SSPBUF               ' Read data from buffer, clears flag.
        HSEROUT [Response, "  -  ", i, 13]
    NEXT

    HSEROUT ["Done...",13]

Goto Main
/Henrik.