| शीर्षक | code-projects Online Hotel Booking IN PHP 1.0 Cross Site Scripting |
|---|
| विवरण | A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Online Hotel Booking System in PHP within the booking functionality.
The vulnerability occurs in the following endpoint:
/hotel booking/booknow.php
The application processes user-controlled input through the roomname parameter supplied via the HTTP GET request. The value of this parameter is reflected in the application response without proper validation or output encoding.
Because the application directly includes the user-supplied value in the HTML output, malicious HTML or JavaScript code can be injected and executed in the browser of users who access a specially crafted URL.
During testing, it was observed that injecting JavaScript code into the roomname parameter results in script execution when the page is rendered.
injected value:
Duplexerwat<script>alert(1)</script>d494k
This indicates that the application fails to properly sanitize or encode user input before rendering it in the browser. |
|---|
| स्रोत | ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20Online%20Hotel%20Booking%20System%20roomname%20Parameter.md |
|---|
| उपयोगकर्ता | AhmadMarzouk (UID 95993) |
|---|
| सबमिशन | 23/03/2026 07:12 PM (6 महीनों पहले) |
|---|
| संयम | 06/04/2026 04:17 PM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 355521 [code-projects Online Hotel Booking 1.0 Booking Endpoint /booknow.php roomname क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|