CVE-2026-5705 in Online Hotel Booking
Summary
by MITRE • 04/07/2026
A vulnerability was identified in code-projects Online Hotel Booking 1.0. Affected by this vulnerability is an unknown functionality of the file /booknow.php of the component Booking Endpoint. Such manipulation of the argument roomname leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/15/2026
This vulnerability resides in the code-projects Online Hotel Booking 1.0 web application where an insecure input handling flaw exists within the booking endpoint functionality. The specific issue manifests in the /booknow.php file where the roomname parameter is not properly sanitized or validated before being processed and rendered back to users. This cross-site scripting vulnerability (XSS) represents a critical security weakness that allows attackers to inject malicious scripts into web pages viewed by other users. The vulnerability falls under CWE-79 which specifically addresses Cross-Site Scripting flaws in web applications, where insufficient validation of user-supplied input leads to execution of unauthorized client-side scripts. The attack vector is remotely exploitable, meaning malicious actors can trigger the vulnerability without requiring physical access to the system or direct user interaction beyond navigating to a compromised page.
The operational impact of this vulnerability extends beyond simple script injection as it provides attackers with potential access to sensitive user data and session information. When users browse pages containing malicious payloads injected through the roomname parameter, their browsers execute the embedded scripts which can steal cookies, redirect them to malicious sites, or perform actions on their behalf. This type of vulnerability directly aligns with ATT&CK technique T1566.001 which covers "Phishing: Spearphishing Attachment" where attackers use web-based attack vectors to compromise user sessions and extract sensitive information. The public availability of exploit code significantly increases the risk as it reduces the barrier to entry for potential attackers and allows for widespread exploitation across multiple installations.
Mitigation strategies should focus on implementing comprehensive input validation and output encoding mechanisms throughout the application's codebase, particularly within the booking endpoint functionality. The most effective immediate solution involves sanitizing all user inputs including the roomname parameter through proper escaping techniques before rendering them in web responses. Implementing Content Security Policy (CSP) headers can provide additional protection against script execution even if input validation is bypassed. Regular security audits and code reviews should be conducted to identify similar vulnerabilities across other endpoints in the application. The remediation process must also include updating the application to a patched version or implementing proper parameter validation frameworks that prevent XSS attacks at the source. Organizations should consider deploying web application firewalls and monitoring tools to detect and block suspicious requests targeting this specific vulnerability. The vulnerability demonstrates the critical importance of input validation as outlined in OWASP Top 10 A03:2021 - Injection flaws, where inadequate protection against injection vulnerabilities can lead to severe consequences including data breaches and unauthorized access to user sessions.