Authored by Rahad Chowdhury

Shuttle Booking Software version 2.0 suffers from multiple persistent cross site scripting vulnerabilities.

advisories | CVE-2023-48172

# Exploit Title: Shuttle Booking Software v2.0 - Multiple Stored Cross-Site
Scripting (Authenticated)
# Date: 09/11/2023
# Exploit Author: BugsBD Security Researcher (Rahad Chowdhury)
# Vendor Homepage:
# Software Link:
# Version: v2.0
# Tested on: Windows 10, Kali Linux
# CVE: CVE-2023-48172

Cross Site Scripting vulnerability in Shuttle Booking Software v.2.0 allows
a remote attacker to execute arbitrary code via the name, description,
title and address parameters in the index.php page.

Steps to Reproduce:
1. At first login your panel.
2. Then use any XSS Payload in "name, description, title and address"
parameters in Location, Lines and Users menus.
3. You will see XSS pop up.

## Reproduce: