The vulnerability resides in the POST Request Handler of itsourcecode Online Hotel Management System 1.0. An attacker can supply arbitrary script content through the Name field of the /admin/mod_amenities/controller.php?action=add endpoint, causing the server to render the input into the browser without adequate sanitization. This facilitates client‑side code execution, which can be used to hijack user sessions, deface pages, or exfiltrate sensitive data. The flaw is a classic reflected cross‑site scripting (XSS) vulnerability as identified by CWE‑79; the additional CWE‑94 indicates that untrusted input may be executed in a different context.

Affected systems match the product catalog for itsourcecode Online Hotel Management System, specifically version 1.0. The vulnerable logic is located in the admin module’s controller for adding amenities, triggered via a POST request. No other product versions or components are explicitly listed as vulnerable.

The CVSS score of 5.3 indicates moderate overall risk. EPSS is not available, and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting limited widespread exploitation data. However, the flaw can be triggered by any remote actor able to issue a crafted POST request, as the description explicitly states remote initiation. Given the public disclosure and lack of a vendor‑supplied fix, the attack vector remains remotely accessible and the potential impact depends on the user’s privileges within the application.