
Proof-of-concept for stored XSS in HotelManager v1.2, demonstrating remote exploitation via comment/contact fields without bypass.
HotelManager - v1.2
Kernel.php; Middleware
Remote
To exploit this vulnerability the user needs to create "rooms" or "guests" or "reservations" or "users" and in the "comment" or "contact" field can execute a xss payload without even doing any bypass.
This is a stored XSS since I was able to store payloads on endpoints (rooms, guests, ...) and trigger them using different accounts.
https://github.com/Saibamen/HotelManager/issues/49 https://github.com/Saibamen/HotelManager/issues/49