xmyronn/cve-2026-10289-xssProof-of-concept for a stored XSS vulnerability in Hotel and Tourism Reservation System 1.0, demonstrating unauthenticated injection and admin session hijacking.
| Field | Details |
|---|
| Title | Hotel and Tourism Reservation System - Stored Cross-Site Scripting (XSS) |
| CVE ID | Pending Assignment |
| Vendor | code-projects.org |
| Vendor URL | https://code-projects.org/hotel-and-tourism-reservation-in-php-with-source-code/ |
| Product | Hotel and Tourism Reservation System |
| Version | 1.0 |
| Vulnerability Type | Stored Cross-Site Scripting |
| CWE | CWE-79 |
| CVSS Score | 8.3 (High) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L |
| Affected Endpoint (Injection) | /ht/tour.php |
| Affected Endpoint (Trigger) | /ht/admin/tour_reserves.php |
| Authentication Required | No (injection) / Yes (trigger) |
| Remote Exploitable | Yes |
| Researcher | Syed Imad Uddin Alvi |
A Stored Cross-Site Scripting (XSS) vulnerability exists in the tour booking functionality of Hotel and Tourism Reservation System 1.0. An unauthenticated attacker can inject arbitrary JavaScript into the booking form fields at /ht/tour.php. The malicious payload is stored in the database without sanitization. When an administrator visits the tour reservations management page at /ht/admin/tour_reserves.php, the stored payload executes in the admin's browser context — enabling session hijacking, credential theft, or full admin account takeover.
File: tour.php (injection point)
File: admin/tour_reserves.php (execution point)
Parameter: name , email , people , number / contact fields (POST)
Storage: hotel_db — tour reservations table
Setup: Install Hotel and Tourism Reservation System 1.0 on XAMPP and access at http://<target>/ht/
Step 1 — Navigate to the tour booking page as an unauthenticated user:
http://<target>/ht/tour.php?tour=4
Step 2 — Enter the XSS payload in the name field or in any field they all vuln to XSS , then click Book Now:
<script>alert(1)</script>
Result: "Reservation successfully made!" — payload is now stored in the database.
Step 3 — Log in as admin and navigate to the tour reservations panel:
http://<target>/ht/admin/tour_reserves.php
Result: The stored XSS payload executes immediately in the admin's browser context.
An unauthenticated attacker can:
The booking form at tour.php stores user input directly in the database without sanitization. The admin panel at tour_reserves.php echoes the stored value raw into the HTML response without output encoding, allowing injected scripts to execute.
// On output — always encode before rendering
echo htmlspecialchars($reservation['name'], ENT_QUOTES, 'UTF-8');
** Imad Alvi** — Independent Security Researcher GitHub: Xmyronn