Cross-Site Scripting in Online Hotel Management System 1.0

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Online Hotel Management System version 1.0, specifically in the file /admin/mod_room/controller.php. It occurs because the application does not properly escape or sanitize user input in the 'name' field of a POST request. An attacker can inject malicious scripts that get stored permanently in the database. When this data is later displayed on a webpage without proper sanitization, the malicious script executes in the victim's browser.

The attack can be launched remotely without any authentication, making it easier for attackers to exploit.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability allows attackers to execute malicious scripts in the context of the victim's browser. This can lead to harmful actions such as stealing user cookies, hijacking user sessions, and conducting phishing attacks.

Because the malicious code is stored in the system and served to users, it can affect multiple users over time, increasing the potential damage.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the POST request handler at the endpoint /admin/mod_room/controller.php?action=add, specifically by injecting malicious scripts into the "name" parameter and observing if the input is stored and later executed without sanitization.

A practical detection method is to send a POST request with a payload such as "<img src=x onerror=alert(2)>" in the "name" field and then check if the script executes when the stored data is viewed.

Example command using curl to test the vulnerability:

• curl -X POST -d "name=<img src=x onerror=alert(2)>" https://[target]/admin/mod_room/controller.php?action=add

After sending this request, verify if the injected script executes when the room data is displayed in the application, indicating the presence of the stored XSS vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include implementing strict input validation and sanitization on the "name" parameter to prevent malicious scripts from being stored.

Additionally, apply output encoding when displaying stored data to ensure that any injected scripts are not executed by the browser.

Filtering or escaping special characters in user inputs and employing security best practices such as Content Security Policy (CSP) can further reduce the risk.

No authentication is required to exploit this vulnerability, so these measures should be prioritized to prevent remote attacks.

Useful 0 Not Useful 0