Executive brief
A security vulnerability exists in the Hotel and Tourism Reservation System, a software package used for managing travel and lodging bookings. An attacker can submit malicious scripts through the public booking form which are then stored and executed when an administrator views the reservation list. This could allow an attacker to hijack administrative sessions, steal credentials, or perform unauthorized actions on the platform.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in code-projects Hotel and Tourism Reservation System 1.0. The flaw is located in the tour booking functionality within /ht/tour.php, where the 'name', 'email', 'people', and 'number' parameters are accepted via POST requests without proper sanitization. These inputs are stored directly in the 'hotel_db' database. When an authenticated administrator accesses the management panel at /ht/admin/tour_reserves.php, the application renders the malicious payload without output encoding. This allows unauthenticated remote attackers to execute arbitrary JavaScript in the admin's browser session, potentially leading to session hijacking or full account takeover. A public exploit is available.
Affected products
- code-projects Hotel and Tourism Reservation System 1.0
Timeline
- 2026-06-01: disclosed
- 2026-06-01: advisory