Submit #897300: code-projects Hotel and Tourism Reservation in PHP 1.0 Cross Site Scripting

The Hotel and Tourism Reservation System in PHP is vulnerable to a potential Reflected Cross-Site Scripting vulnerability in the room parameter processed by the details.php endpoint.

The affected page accepts a room identifier through the URL query string and uses this value while displaying room information or processing reservation-related functionality.

The application appears to accept arbitrary user-controlled characters in the room parameter. The supplied proof-of-concept value contains characters designed to terminate an existing HTML context followed by an executable <script> element.

The decoded malicious value is:

15hcpdj"><script>alert(1)</script>g2whhcd19l7
The relevant injected JavaScript component is:

<script>alert(1)</script>
If the application directly inserts the supplied room parameter into an HTML response without encoding special characters such as <, >, ", and ', an attacker-controlled value can alter the structure of the generated HTML document.

When a victim follows a specially crafted URL containing the malicious room value, the application reflects the payload into the response. The victim's browser then interprets the injected markup as executable content and runs the JavaScript in the security context of the affected application.

Unlike Stored XSS, the malicious value does not necessarily remain in the application's database. Exploitation typically requires the attacker to convince a victim to visit a specially crafted URL or otherwise initiate the affected request.

Successful exploitation may allow arbitrary JavaScript execution within the victim's browser session. Depending on the victim's authentication state and the application's security controls, an attacker may potentially perform unauthorized actions using the victim's active session, alter displayed content, access information available to client-side scripts, or display deceptive content within the trusted application origin.

The vulnerability results from the application's failure to apply proper contextual output encoding to user-controlled URL parameters before including them in dynamically generated HTML.

• Source: ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20Hotel%20and%20Tourism%20Reservation%20System%20%60room%60%20Parameter.md
• User: AhmadMarzouk (UID 95993)
• Submission: 07/20/2026 12:28 (2 months ago)
• Moderation: 09/05/2026 21:07 (2 months later)
• Status: Accepted
• VulDB entry: 399354 [code-projects Hotel and Tourism Reservation in PHP 1.0 /ht/details.php room cross site scripting]
• Points: 20