# Exploit Title: Seat Reservation System 1.0 Persistent Cross-Site Scripting # Date: 10-08-2020 # Exploit Author: George Tsimpidas # Vendor Homepage: www.sourcecodester.com # Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/seat-reservation-system-using-php_0.zip # Version: 1.0 # Tested on: Ubuntu 18.04.5 LTS (Bionic Beaver) # Category: Webapp Description : The file movie_list.php does not sanitize correctly the description drop down menu on the edit mode, therefore it echoes out the data on the parsed ID number of the current indicated movie. Culprit : #########################################################################