CVE-2026-2159: Tourism Website XSS Vulnerability

CVE-2026-2159 Overview

A Cross-Site Scripting (XSS) vulnerability has been identified in SourceCodester Simple Responsive Tourism Website version 1.0. The flaw exists in the Registration component, specifically within the file /tourism/classes/Master.php?f=register. An attacker can exploit this vulnerability by manipulating the firstname, lastname, or username parameters to inject malicious scripts that execute in the context of a victim's browser session.

Critical Impact

This XSS vulnerability allows remote attackers to inject arbitrary client-side scripts into the registration form, potentially leading to session hijacking, credential theft, or malicious redirects affecting users of the tourism website platform.

Affected Products

• SourceCodester Simple Responsive Tourism Website 1.0
• oretnom23 simple_responsive_tourism_website

Discovery Timeline

• February 8, 2026 - CVE-2026-2159 published to NVD
• February 10, 2026 - Last updated in NVD database

Technical Details for CVE-2026-2159

Vulnerability Analysis

This vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting). The Registration component fails to properly sanitize user-supplied input in the firstname, lastname, and username fields before including them in dynamically generated web pages.

When a user submits registration data through the affected endpoint, the application processes the input without adequate validation or encoding. This allows an attacker to craft malicious input containing JavaScript code that will be rendered and executed when the page is displayed to other users or administrators viewing the registration data.

The vulnerability requires user interaction to exploit, as a victim must view or interact with content containing the injected payload. However, the attack can be launched remotely without authentication, making it accessible to any external attacker who can access the registration form.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding in the Master.php file's registration handler. The application directly incorporates user-supplied values from the firstname, lastname, and username parameters into the HTML response without proper sanitization or escaping of special characters such as <, >, ", and '.

Attack Vector

The attack vector is network-based, allowing remote exploitation. An attacker can craft a malicious registration request containing XSS payloads in any of the vulnerable parameters. The attack flow typically involves:

1. An attacker submits a registration form with malicious JavaScript embedded in the firstname, lastname, or username fields
2. The application stores or reflects the unsanitized input
3. When an administrator or another user views the malicious data, the injected script executes in their browser context
4. The attacker can then steal session cookies, perform actions on behalf of the victim, or redirect users to phishing sites

Technical details and proof-of-concept information are available in the GitHub CVE Report.

Detection Methods for CVE-2026-2159

Indicators of Compromise

• Unusual registration entries containing HTML tags, JavaScript keywords (<script>, onerror, onload), or encoded payloads in user profile fields
• Web server logs showing registration requests with suspicious special characters or URL-encoded script tags in the firstname, lastname, or username parameters
• Unexpected JavaScript execution errors in browser console logs when viewing user registration data

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block XSS payloads in form submissions targeting /tourism/classes/Master.php
• Implement input validation monitoring to alert on registration attempts containing script tags or event handlers
• Review application logs for registration requests with unusual character sequences indicative of XSS attacks

Monitoring Recommendations

• Enable detailed logging for the Registration component to capture all form submission data
• Configure security monitoring tools to alert on patterns matching common XSS payload signatures
• Implement Content Security Policy (CSP) headers and monitor CSP violation reports for injection attempts

How to Mitigate CVE-2026-2159

Immediate Actions Required

• Implement server-side input validation to reject registration data containing HTML tags or JavaScript code
• Apply output encoding (HTML entity encoding) to all user-supplied data before rendering in web pages
• Deploy a Web Application Firewall with XSS protection rules as an interim defensive measure
• Consider temporarily restricting access to the registration functionality until a patch is applied

Patch Information

No official vendor patch has been released at this time. Organizations using SourceCodester Simple Responsive Tourism Website 1.0 should contact the vendor at SourceCodester for security updates. Additional vulnerability details are available through VulDB #344861.

Workarounds

• Implement custom input sanitization by modifying the Master.php file to filter or escape special characters in the firstname, lastname, and username parameters
• Add Content Security Policy (CSP) headers to prevent execution of inline scripts and mitigate the impact of successful XSS attacks
• Restrict access to the registration feature to trusted networks or authenticated users only until the vulnerability is properly addressed

# Example Apache configuration to add CSP headers
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
</IfModule>