The bug resides in the book_flight.php file of itsourcecode Airline Reservation System, allowing an attacker to inject arbitrary JavaScript via manipulation of the max query parameter. When a vulnerable client visits a crafted URL, the injected script runs in the victim's browser, resulting in classic XSS effects such as cookie theft, session hijacking, or defacement. The weakness is a classic input validation flaw covered by CWE‑79, with secondary code‑injection concerns identified by CWE‑94.

itsourcecode Airline Reservation System 1.0 is the only product affected. The vulnerability is triggered by supplying a specially crafted max argument to the /book_flight.php endpoint, and any installation of the 1.0 release that has not been patched will be vulnerable.

With a CVSS score of 5.3 the issue is considered moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting that while exploitation is feasible, it is not currently known to be widespread. A remote attacker can craft a URL and entice a user to visit it, leading to client‑side compromise. The lack of an identified workaround means mitigations must rely on patching or defensive controls.