Description

A Stored Cross-Site Scripting (XSS) vulnerability exists in the booking.php file of Home Service System In PHP 1.0. Unauthenticated users can inject malicious JavaScript payloads through the booking form fields. The unsanitized input is stored in the database and rendered without output encoding in the admin panel (admin.php), where it executes in the administrator's browser context.

This allows an unauthenticated attacker to steal the admin session cookie, perform actions on behalf of the administrator, or fully compromise the admin account.

Affected Component

• File: booking.php
• Parameters: fname, lname
• Sink: admin.php → Manage Booking

Steps to Reproduce

1. Navigate to the booking page as an unauthenticated user: http://TARGET/homeservices/booking.php?provider=

   

2. In the First Name field, inject the following payload:

3. Fill remaining fields with any valid data and submit the booking.

4. Start a listener on your attacker machine:

5. Wait for the administrator to visit the Manage Booking section in admin.php.

6. The payload executes in the admin's browser, exfiltrating the session cookie to your listener.

   

Proof of Concept

Payload (Alert)

Payload (Session Hijack)

Impact

This vulnerability allows a remote unauthenticated attacker to fully compromise the application.

An attacker can:

• Execute arbitrary JavaScript in the administrator's browser
• Steal the admin PHPSESSID session cookie
• Hijack the admin session and gain full administrative access
• Perform any administrative action (manage bookings, providers, etc.)

This results in complete application compromise.

Remediation

• Apply htmlspecialchars() with ENT_QUOTES on all user-supplied input before storing or rendering
• Implement a Content Security Policy (CSP) header
• Validate and sanitize all form inputs server-side

References

• Home Service System In PHP - code-projects.org