CVE-2026-10289: Hotel Tourism Reservation XSS Vulnerability

CVE-2026-10289 Overview

CVE-2026-10289 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in code-projects Hotel and Tourism Reservation System 1.0. The flaw resides in the /ht/tour.php script, where the name, email, people, and number parameters are not properly sanitized before being rendered. Attackers can inject arbitrary JavaScript that executes in the context of users who view the affected page. The exploit has been publicly released, increasing exposure for unpatched deployments.

Critical Impact
Remote attackers can inject persistent JavaScript payloads via the booking form, enabling session theft, credential harvesting, and client-side actions against authenticated users.

Affected Products

code-projects Hotel and Tourism Reservation System 1.0
Component: /ht/tour.php
Vulnerable parameters: name, email, people, number

Discovery Timeline

2026-06-01 - CVE-2026-10289 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-10289

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting issue in the tour booking workflow of the Hotel and Tourism Reservation System. The /ht/tour.php endpoint accepts user-supplied input through the name, email, people, and number parameters. The application stores this input and later renders it in HTML responses without applying output encoding or input sanitization.

Because the payload is persisted, every user who loads the affected view executes the injected script in their browser. The attack requires user interaction to trigger payload execution, but no authentication is needed to submit the malicious input. Public availability of the proof-of-concept on GitHub lowers the barrier for opportunistic exploitation.

Root Cause

The root cause is missing input validation and output encoding on the affected parameters in /ht/tour.php. The application trusts client-supplied data and writes it directly into HTML context, allowing <script> tags and event-handler attributes to be interpreted by the browser. This is a classic Improper Neutralization of Input During Web Page Generation pattern tracked as [CWE-79].

Attack Vector

An unauthenticated attacker submits a crafted booking request to /ht/tour.php containing JavaScript payloads in the name, email, people, or number fields. The server stores the payload, and subsequent visitors, including administrators reviewing reservations, trigger script execution. The attacker can hijack sessions, exfiltrate cookies, redirect users, or perform actions on behalf of victims within the application context.

A public proof-of-concept is available at the GitHub PoC Repository, which demonstrates payload injection through the booking form.

Detection Methods for CVE-2026-10289

Indicators of Compromise

HTTP POST requests to /ht/tour.php containing <script>, onerror=, onload=, or javascript: substrings in the name, email, people, or number parameters.
Database records in reservation tables holding HTML or JavaScript fragments instead of plain text values.
Outbound requests from administrator browsers to attacker-controlled domains immediately after viewing reservation pages.

Detection Strategies

Inspect web server access logs for requests to /ht/tour.php containing URL-encoded angle brackets (%3C, %3E) or common XSS keywords in the affected parameters.
Deploy a Web Application Firewall (WAF) rule that flags script tags and JavaScript event handlers submitted to the booking endpoint.
Audit stored reservation data for HTML markup or scripting syntax that should not appear in name, email, or numeric fields.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script execution attempts on reservation pages.
Forward web server and database query logs to a centralized log platform and alert on suspicious payload patterns targeting /ht/tour.php.
Monitor administrator session activity for anomalous cookie access or unexpected outbound connections after browsing reservation listings.

How to Mitigate CVE-2026-10289

Immediate Actions Required

Restrict public access to /ht/tour.php or take the affected application offline until input handling is corrected.
Apply WAF rules to block requests containing scripting syntax in the name, email, people, and number parameters.
Purge stored reservation records that contain HTML or JavaScript content to prevent continued payload delivery.

Patch Information

No official vendor patch has been published for code-projects Hotel and Tourism Reservation System 1.0 at the time of writing. Refer to the VulDB CVE-2026-10289 entry and the Code Projects Resources page for vendor updates. Operators should implement source-level fixes by validating parameter types and applying contextual HTML output encoding before rendering user input.

Workarounds

Implement server-side input validation that rejects non-alphanumeric characters in people and number fields and enforces RFC-compliant email syntax on the email field.
Apply HTML entity encoding to all reservation data before insertion into response pages.
Deploy a strict Content Security Policy that disallows inline scripts and untrusted external script sources on the application.

bash

# Example NGINX configuration to block obvious XSS payloads on the affected endpoint
location /ht/tour.php {
    if ($args ~* "(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'";
    add_header X-XSS-Protection "1; mode=block";
}