A vulnerability was determined in itsourcecode Online Hotel Management System 1

CVE-2026-13556 is a *cross-site scripting* flaw (CWE-79) in itsourcecode Online Hotel Management System v1.0, a free PHP/MySQL learning project distributed via itsourcecode.com. An unauthenticated attacker crafts a URL whose payload is reflected into a page parameter; if a victim clicks it, JavaScript runs in their browser session against the application origin. The vendor has issued no patched version — the project is essentially abandonware used for student capstones, with the GitHub mirror unmaintained.

The vendor severity of MEDIUM 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) is mechanically correct for a reflected XSS that requires user interaction and only impacts integrity at low scope. But mechanical CVSS misses the bigger truth: this codebase should not be running anywhere except a classroom VM. If it *is* on your network, the XSS is the least of your problems — itsourcecode projects have a long tail of SQLi, auth bypass, and arbitrary file upload bugs in the same files.

Why this verdict

• Friction — user interaction required: reflected XSS needs a victim with an active session to click an attacker URL, gated by email security and URL rewriting at most enterprises.
• Friction — population near zero: Shodan/Censys exposure is double digits globally and skews to lab/student IPs; an enterprise running this in production is an artifact, not a norm.
• Friction — impact ceiling is one tenant: even on a successful run, the attacker controls JS in one hotel's admin UI; no lateral movement primitive, no privilege escalation, no data tier breach beyond what the same codebase's SQLi bugs already hand over.
• Role multiplier: there is no high-value-role variant. This product never occupies an IdP, hypervisor, CA, backup, EDR, network-edge, CI/CD, or SIEM slot — the role multiplier floor does not engage, so friction is free to drive the verdict down past MEDIUM.
• No KEV, no campaigns, no PoC weaponization — sits in the lowest tier of the threat landscape.

Why not higher?

MEDIUM would require either meaningful enterprise prevalence or a sensitive-data integrity impact; neither applies. The CVSS C:N rating already concedes there is no confidentiality leak primitive, and the user-interaction requirement collapses any drive-by scenario.

Why not lower?

IGNORE would be wrong if you actually run this code — XSS in an admin app is still a real session-takeover primitive against the one tenant. LOW correctly flags it as backlog hygiene for the rare org that hosts it, without burning paging-cycles.

1. Remove the application from any production or internet-reachable host — itsourcecode projects are tutorial code, not products. If you find one running, the correct control is decommission, not patch. No mitigation SLA at LOW — fold into backlog hygiene.
2. If the app must stay, front it with a WAF in blocking mode — ModSecurity CRS, Cloudflare Managed Rules, or AWS WAF Core ruleset blocks default reflected-XSS payloads at paranoia level 1. Configure once, no SLA pressure.
3. Set HttpOnly and Secure flags on session cookies in php.ini — session.cookie_httponly=1, session.cookie_secure=1, session.cookie_samesite=Lax. Neutralizes the cookie-theft path of any reflected XSS in this codebase without touching source.
4. Add a strict Content-Security-Policy at the reverse proxy — Content-Security-Policy: default-src 'self'; script-src 'self' injected via nginx/Apache headers blocks inline <script> execution from reflected sinks.

Run on the web server hosting the app as any user with read access to the docroot. Invoke as bash check_cve_2026_13556.sh /var/www/html/hotel. No root needed; the script greps the source tree for the itsourcecode signature files and unsanitized echo patterns.

#!/usr/bin/env bash
# CVE-2026-13556 — itsourcecode Online Hotel Management System 1.0 reflected XSS
# Usage: ./check_cve_2026_13556.sh <docroot>
set -u
ROOT="${1:-/var/www/html}"
if [[ ! -d "$ROOT" ]]; then
  echo "UNKNOWN: docroot $ROOT not found"
  exit 2
fi

# 1. Is this the itsourcecode Online Hotel Management System?
if ! grep -RIl --include='*.php' -E 'Online Hotel Management System|itsourcecode' "$ROOT" >/dev/null 2>&1; then
  echo "PATCHED: itsourcecode Online Hotel Management System not present under $ROOT"
  exit 0
fi

# 2. Look for unsanitized echo of GET/REQUEST input — the CWE-79 sink pattern
HITS=$(grep -RIn --include='*.php' -E 'echo[[:space:]]+\$_(GET|REQUEST|POST)\[' "$ROOT" 2>/dev/null | wc -l)
SAN=$(grep -RIn --include='*.php' -E 'htmlspecialchars|htmlentities|filter_var' "$ROOT" 2>/dev/null | wc -l)

if [[ "$HITS" -gt 0 && "$SAN" -eq 0 ]]; then
  echo "VULNERABLE: itsourcecode app present with $HITS unsanitized echo sinks and no sanitization helpers"
  exit 1
elif [[ "$HITS" -gt 0 ]]; then
  echo "VULNERABLE: itsourcecode app present with $HITS unsanitized echo sinks (some sanitization seen, manual review required)"
  exit 1
else
  echo "UNKNOWN: itsourcecode app present but no obvious sink pattern — review source manually"
  exit 2
fi

Sources

1. CISA Vulnerability Summary — Week of June 15, 2026
2. CISA Vulnerability Summary — Week of June 1, 2026
3. OpenCVE — Hotel Management System product CVEs
4. Related itsourcecode CVE-2026-5551 (Free Hotel Reservation System)
5. Related itsourcecode CVE-2026-3730 SQLi writeup
6. Related itsourcecode CVE-2026-3152 (College Management System)
7. Related itsourcecode CVE-2026-13520 (Hospital Management System)
8. OWASP — Cross-Site Scripting (XSS) reference