| 제목 | code-projects Online Hotel Booking IN PHP 1.0 Cross Site Scripting |
|---|
| 설명 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Online Hotel Booking System in PHP within the booking functionality.
The vulnerability occurs in the following endpoint:
/hotel booking/booknow.php
The application processes user-controlled input through the roomname parameter supplied via the HTTP GET request. The value of this parameter is reflected in the application response without proper validation or output encoding.
Because the application directly includes the user-supplied value in the HTML output, malicious HTML or JavaScript code can be injected and executed in the browser of users who access a specially crafted URL.
During testing, it was observed that injecting JavaScript code into the roomname parameter results in script execution when the page is rendered.
injected value:
Duplexerwat<script>alert(1)</script>d494k
This indicates that the application fails to properly sanitize or encode user input before rendering it in the browser. |
|---|
| 원천 | ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20Online%20Hotel%20Booking%20System%20roomname%20Parameter.md |
|---|
| 사용자 | AhmadMarzouk (UID 95993) |
|---|
| 제출 | 2026. 03. 23. PM 07:12 (6 개월 ago) |
|---|
| 모더레이션 | 2026. 04. 06. PM 04:17 (14 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 355521 [code-projects Online Hotel Booking 1.0 Booking Endpoint /booknow.php roomname 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|