CVE-2026-13554: Hotel Management System XSS Vulnerability

CVE-2026-13554 Overview

CVE-2026-13554 is a cross-site scripting (XSS) vulnerability in itsourcecode Online Hotel Management System 1.0. The flaw exists in the /admin/mod_amenities/controller.php?action=add endpoint, which handles POST requests for adding amenities. Attackers can inject malicious script content through the Name parameter, which the application processes without proper sanitization.

The vulnerability is remotely exploitable and requires user interaction to trigger. Public disclosure has occurred, and the exploit details are available, increasing the risk of opportunistic attacks against exposed installations.

Critical Impact
Authenticated or tricked administrators visiting a crafted page can execute attacker-supplied JavaScript in the context of the admin interface, potentially exposing session data and administrative actions.

Affected Products

itsourcecode Online Hotel Management System 1.0
Component: /admin/mod_amenities/controller.php POST Request Handler
Vulnerable parameter: Name

Discovery Timeline

2026-06-29 - CVE-2026-13554 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-13554

Vulnerability Analysis

The vulnerability is classified as Cross-Site Scripting [CWE-79]. The application accepts a Name value from a POST request submitted to /admin/mod_amenities/controller.php?action=add and reflects or stores the input without adequate output encoding.

When the injected value renders in an administrator's browser, the browser interprets attacker-controlled markup as executable script. This allows an attacker to run JavaScript in the context of the vulnerable web application. Because the affected endpoint is part of the administrative amenities module, exploitation targets privileged sessions.

The EPSS score for this issue is 0.443%, indicating a low near-term probability of large-scale exploitation. The vulnerability affects confidentiality of the admin interface but does not directly enable code execution on the server.

Root Cause

The root cause is missing input validation and output encoding on the Name parameter. The controller writes user-supplied text into HTML contexts without escaping characters such as <, >, ", and '. Frameworks or manual encoding routines that would neutralize script payloads are absent from the amenity-add workflow.

Attack Vector

An attacker crafts a payload containing HTML or JavaScript and delivers it to the Name field through the add action. Delivery can occur through a phishing link, a cross-site request forgery scenario, or direct submission if the attacker holds low-privilege access. When an administrator views the amenities list or a reflected response page, the payload executes in their browser session.

The vulnerability manifests in the amenity creation handler and does not require complex bypasses. See the GitHub CVE Issue Discussion and VulDB CVE-2026-13554 for reference technical details.

Detection Methods for CVE-2026-13554

Indicators of Compromise

POST requests to /admin/mod_amenities/controller.php?action=add containing HTML tags such as <script>, <img, onerror=, or onload= in the Name parameter.
Administrator sessions producing outbound requests to unfamiliar domains shortly after visiting the amenities module.
Unexpected new amenity records containing markup or JavaScript in the name field.

Detection Strategies

Inspect web server access logs for POST bodies to the amenities add endpoint containing encoded angle brackets (%3C, %3E) or common XSS payload signatures.
Deploy a web application firewall (WAF) rule set to flag script-like tokens in the Name parameter on the affected path.
Review the amenities database table for stored entries containing HTML or JavaScript syntax.

Monitoring Recommendations

Monitor administrator browser sessions for anomalous DOM activity or unexpected script sources on admin pages.
Alert on repeated failed and successful submissions to /admin/mod_amenities/controller.php from the same source address within short intervals.
Track referer headers on admin endpoints to identify cross-site navigation flows that may indicate CSRF-assisted XSS delivery.

How to Mitigate CVE-2026-13554

Immediate Actions Required

Restrict network access to the /admin/ path so that only trusted administrator IP ranges can reach the module.
Apply server-side input validation to the Name parameter, rejecting values containing HTML control characters.
Enforce a Content Security Policy (CSP) that blocks inline scripts and untrusted script sources on administrative pages.

Patch Information

No vendor patch is currently referenced in the NVD entry for CVE-2026-13554. Administrators should monitor the IT Source Code project site for updates and consult the VulDB Vulnerability #374562 record for the latest remediation status.

Workarounds

Add server-side output encoding to all locations that render the Name field, converting <, >, ", ', and & to their HTML entity equivalents.
Deploy a WAF rule that blocks POST requests to controller.php?action=add when the Name parameter contains angle brackets or JavaScript event handler names.
Require reauthentication for privileged actions in the amenities module to reduce the impact of hijacked sessions.

bash

# Example WAF rule (ModSecurity) blocking script payloads in the Name parameter
SecRule REQUEST_URI "@contains /admin/mod_amenities/controller.php" \
  "phase:2,chain,deny,status:403,id:1013554,\
   msg:'CVE-2026-13554 XSS attempt in Name parameter'"
  SecRule ARGS:Name "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none,t:urlDecodeUni"