Code-Projects酒店预订系统room参数反射型XSS漏洞分析

漏洞关键信息总结 漏洞概述 漏洞名称：Hotel and Tourism Reservation System 中 参数的反射型跨站脚本（Reflected XSS） 漏洞类型：反射型 XSS（Reflected Cross-Site Scripting） CWE：CWE-79 – 在 Web 页面生成过程中未正确中和输入（跨站脚本） OWASP Top 10：A03.2021 – 注入（Injection） 严重等级：中危（Medium） CVSS v3.1 评分：6.1（Medium） 产品：PHP 编写的 Hotel and Tourism Reservation System 供应商：Code-Projects 受影响端点： 易受攻击参数： 影响范围 该参数用于接收房间标识符，但应用未对输入做上下文编码，直接将用户可控值插入 HTML 响应。 攻击者可构造恶意 URL，诱导受害者访问后，浏览器将注入的 当作可执行 JavaScript 运行。 成功利用可在受害者浏览器中执行任意 JavaScript，可能导致会话劫持、信息泄露或执行客户端脚本。 修复方案 对 参数进行严格的服务器端校验（如限定为数字型房间号）。 在输出到 HTML 前对特殊字符（ , , , , 等）进行上下文编码。 不要将 URL 参数直接当作 HTML 内容信任使用。 示例修复思路：拒绝非数字值，或对输出做 HTML 实体编码。 POC / 利用代码 测试载荷（Test Payload）： 完整 HTTP 请求（Full HTTP Request）： ``` GET /nt/details.php?room=5hqp%2N2%8c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c%28c

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

Code-Projects酒店预订系统room参数反射型XSS漏洞分析

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Code-Projects酒店预订系统room参数反射型XSS漏洞分析

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！