cgpandey hotelmis Cross-Site Scripting Vulnerability in admin.php

A cross-site scripting (XSS) vulnerability has been identified in cgpandey hotelmis versions prior to commit c572198e6c4780fccc63b1d3e8f3f72f825fc94e. The issue arises in the file admin.php within the HTTP GET Request Handler component. The vulnerability is triggered by manipulating the 'Search' argument, allowing for the injection of malicious scripts. This issue can be exploited remotely, but requires user interaction from the victim.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the admin.php file with a crafted 'Search' parameter that includes the script payload. The injected script will be executed in the context of the user.