CVE-2026-5705

Vulnerability

Description CVE-2026-5705 is a reflected cross-site scripting (XSS) vulnerability in code-projects Online Hotel Booking 1.0. The flaw exists in the /booknow.php endpoint within the booking functionality. The application directly reflects user input from the roomname GET parameter into the HTML response without proper sanitization or output encoding, such as htmlspecialchars() [1]. This allows attackers to inject arbitrary HTML or JavaScript code.

Exploitation

An attacker can craft a malicious URL containing JavaScript in the roomname parameter and trick a victim into clicking it. No authentication or special privileges are required; the attack can be launched remotely via a simple GET request. The exploit is publicly available, lowering the barrier for exploitation [1].

Impact

Successful exploitation results in arbitrary script execution in the victim's browser within the context of the hotel booking application. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The CVSS v3 base score is 4.3 (Medium), reflecting the need for user interaction [1].

Mitigation

As of the advisory date, no official patch has been released by the vendor [2]. Users are advised to avoid clicking untrusted links pointing to the booking system and to implement input validation and output encoding in the roomname parameter. Given the public exploit, organizations using this software should consider upgrading or applying virtual patching if available.