Cross-Site Scripting in code-projects Online Hotel Booking Booking Endpoint

Executive Summary

CVE-2026-5705 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Online Hotel Booking System v1.0, specifically in the booking functionality at the endpoint /hotel booking/booknow.php. The vulnerability arises because the application takes the user-supplied 'roomname' parameter from HTTP GET requests and directly inserts it into the HTML response without any sanitization or output encoding.

This lack of sanitization allows an attacker to inject malicious HTML or JavaScript code, which then executes in the victim's browser when they access a crafted URL containing the malicious payload.

For example, an attacker can craft a URL that includes a script tag in the 'roomname' parameter, causing arbitrary JavaScript to run in the user's browser.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have several impacts on users and the application, including:

• Execution of arbitrary JavaScript code in users' browsers.
• Theft of session cookies, which can lead to user session hijacking.
• Unauthorized actions performed on behalf of users without their consent.
• Redirecting users to malicious websites.
• Facilitating phishing attacks by injecting deceptive content.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the booking endpoint /booknow.php with crafted HTTP GET requests that inject JavaScript code into the roomname parameter.

A simple detection method is to send a request with a payload such as <script>alert(1)</script> in the roomname parameter and observe if the script executes in the response.

Example command using curl to test the vulnerability:

• curl -i "http://localhost/hotel%20booking/booknow.php?roomname=<script>alert(1)</script>"

If the response contains the injected script without proper encoding or sanitization, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include properly encoding user input before rendering it in HTML to prevent script execution.

• Use PHP's htmlspecialchars() function to encode the roomname parameter, for example: echo htmlspecialchars($roomname, ENT_QUOTES, 'UTF-8');
• Validate and sanitize all user inputs to reject unexpected or malicious characters.
• Implement Content Security Policy (CSP) headers to restrict the sources of executable scripts, e.g., Content-Security-Policy: default-src 'self'

These steps help prevent the execution of injected scripts and reduce the risk of cross-site scripting attacks.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability described is a Reflected Cross-Site Scripting (XSS) issue that allows execution of arbitrary JavaScript in users' browsers, which can lead to session hijacking, unauthorized actions, and phishing attacks.

Such security weaknesses can impact compliance with common standards and regulations like GDPR and HIPAA because they may lead to unauthorized access to personal or sensitive data, compromise user privacy, and fail to ensure adequate protection of user information.

Specifically, GDPR requires organizations to implement appropriate technical measures to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction or damage. An XSS vulnerability that allows session hijacking or data theft could be considered a failure to meet these requirements.

Similarly, HIPAA mandates safeguards to ensure the confidentiality, integrity, and availability of electronic protected health information (ePHI). An XSS vulnerability could enable attackers to access or manipulate ePHI, thus violating HIPAA security rules.

Useful 0 Not Useful 0