Hotel Portal HTML Injection Vulnerability

vendor:

Hotel Portal

by:

Unknown

7.5

CVSS

HIGH

HTML Injection

CWE

Product Name: Hotel Portal

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2011

Hotel Portal HTML Injection Vulnerability

Hotel Portal is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize user-supplied data before using it in HTML output. Input validation and output encoding can help prevent HTML injection attacks.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/49297/info

Hotel Portal is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. 

http://www.example.com/city.php?hotel_city=%22%2F%3E%3C%2Fa%3E%3C%2F%3E%3Cimg+src%3D1.gif+onerror%3Dalert%281%29%3E&dayfrom=23&monthfrom=8&yearfrom=2011&dayback=24&monthback=8&yearback=2011&guest=1&rooms=1&hotel_stars=&pricefrom=0&pricetill=250&B1=Search