Stored XSS in itsourcecode Online Hotel Management System Room Name Parameter

#!/usr/bin/env bash
# check_cve_2026_13557.sh — Detect itsourcecode Online Hotel Management System 1.0
# CVE-2026-13557: Stored XSS in /admin/mod_room/controller.php
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=VULNERABLE, 1=PATCHED/NOT_FOUND, 2=UNKNOWN

set -euo pipefail

TARGET_URL="${1:-}"
FOUND=0

# --- Filesystem check (common XAMPP/WAMP/Linux paths) ---
WEB_ROOTS=(
  "/opt/lampp/htdocs"
  "/var/www/html"
  "/var/www"
  "/usr/share/nginx/html"
)

VULN_FILE="admin/mod_room/controller.php"

for root in "${WEB_ROOTS[@]}"; do
  if [ -f "${root}/${VULN_FILE}" ]; then
    echo "[!] Found vulnerable file: ${root}/${VULN_FILE}"
    # Check if any output encoding is present (rudimentary)
    if grep -qP 'htmlspecialchars|htmlentities|strip_tags|esc_attr' "${root}/${VULN_FILE}" 2>/dev/null; then
      echo "[i] Output encoding function detected — may be patched."
    else
      echo "[!] No output encoding found — VULNERABLE"
      FOUND=1
    fi
  fi
done

# --- URL fingerprint check ---
if [ -n "${TARGET_URL}" ]; then
  PROBE_URL="${TARGET_URL}/admin/mod_room/controller.php?action=add"
  HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' --max-time 10 "${PROBE_URL}" 2>/dev/null || echo "000")
  if [ "${HTTP_CODE}" = "200" ] || [ "${HTTP_CODE}" = "302" ]; then
    echo "[!] Admin room endpoint responded (HTTP ${HTTP_CODE}) at ${PROBE_URL}"
    FOUND=1
  elif [ "${HTTP_CODE}" = "000" ]; then
    echo "[?] Could not reach ${PROBE_URL}"
  else
    echo "[i] Endpoint returned HTTP ${HTTP_CODE} — likely not present or access-controlled."
  fi
fi

# --- Verdict ---
if [ "${FOUND}" -eq 1 ]; then
  echo "VULNERABLE"
  exit 0
elif [ "${FOUND}" -eq 0 ] && { [ ${#WEB_ROOTS[@]} -gt 0 ] || [ -n "${TARGET_URL}" ]; }; then
  echo "PATCHED"
  exit 1
else
  echo "UNKNOWN"
  exit 2
fi