Description

A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of the file /ht/details.php. The manipulation of the argument room leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-06T14:17:25.760Z",
  "pubdate": "2026-09-06T14:17:25.760Z",
  "executiveSummary": "A reflected cross-site scripting (XSS) vulnerability exists in the Hotel and Tourism Reservation 1.0 application. This vulnerability arises from improper neutralization of user-supplied input within the /ht/details.php file.\nBy manipulating the 'room' parameter, an unauthenticated remote attacker can inject arbitrary malicious JavaScript into the victim's browser context.\nSuccessful exploitation allows for the execution of unauthorized scripts, which can lead to session hijacking, credential theft, redirection to malicious domains, or unauthorized content modification on the affected page.\nGiven that the exploit is disclosed publicly, the risk to deployments is elevated, as the vulnerability can be leveraged by remote threat actors without requiring prior authentication or specific privileges. The flaw represents a significant security risk for users interacting with the reservation system.",
  "technicalDetails": "The vulnerability is identified as a reflected cross-site scripting (XSS) flaw localized within the /ht/details.php script. The root cause is the failure of the application to properly sanitize or encode input received via the 'room' GET parameter before rendering it back to the client-side HTML document.\nThe attack flow begins when an attacker crafts a malicious URI containing an XSS payload within the 'room' parameter. When a victim is induced to visit this crafted link, the server-side code in /ht/details.php processes the input and reflects the payload directly into the response body without sufficient context-aware escaping. As a result, the victim's browser interprets the injected data as legitimate executable code rather than plain text.\nSince this is a reflected XSS, the payload does not persist on the server but is transient, executing only in the context of the user who clicks the link. However, the impact remains severe. Because the script executes within the security origin of the target domain, the injected code can access sensitive data such as session cookies, local storage, or authentication tokens. Furthermore, the script can perform actions on behalf of the user, such as changing account details or submitting fraudulent reservation requests.\nThe vulnerable component is identified as /ht/details.php, which explicitly fails to implement adequate input validation or output encoding mechanisms. This exposure is accessible over the network, and the exploitability is high because it does not require authentication or elevated system privileges. The attack is trivial to execute by simply sending a crafted HTTP GET request to the vulnerable endpoint. The lack of Content Security Policy (CSP) headers or similar browser-side protections exacerbates the risk, allowing the execution of inline scripts and unauthorized external resource loading initiated by the injected payload."
}