SourceCodester Hotel Management System Search search cross site scripting

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in SourceCodester Hotel Management System version 2.0. The issue is located in the /ci_hms/search endpoint, where the search parameter is not properly sanitized. An attacker can inject arbitrary JavaScript code through this parameter, which is then reflected back to the user in the response [1]. No special configuration or authentication is required to trigger the vulnerability.

Exploitation

An attacker can exploit this vulnerability by crafting a HTTP POST request to /ci_hms/search with a malicious payload in the search parameter. For example, the input "> will cause the script to execute in the victim's browser when they view the response. The attack can be initiated remotely, and no user interaction beyond viewing the response is required [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to cookie theft, session hijacking, defacement, or redirection to malicious sites. The impact is primarily on confidentiality and integrity, potentially compromising user sessions and data [1].

Mitigation

As of the publication date (2022-07-12), no official patch has been released by the vendor. Users are advised to implement input validation and output encoding for the search parameter to prevent XSS attacks. Additionally, consider using a Web Application Firewall (WAF) or content security policy (CSP) headers to mitigate the risk [1].