Authored by CraCkEr

Travelable version 1.0 suffers from a persistent cross site scripting vulnerability.

# Exploit Title: Travelable 1.0 - Stored XSS
# Exploit Author: CraCkEr
# Date: 15/07/2023
# Vendor:
# Vendor Homepage:
# Software Link:
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site

## Description

Allow Attacker to inject malicious code into website, give ability to steal sensitive
information, manipulate data, and launch additional attacks.

Path: /[random-number]/comment

POST parameter 'comment' is vulnerable to XSS

POST /[random-number]/comment HTTP/2

_token=10Mh1zuuVXB1iH3QsrEOqpWGOXogEv38WPwqGtv6&name=cracker+infosec&[XSS Payload]

## Steps to Reproduce:

1. Surf as a (Guest User)
2. Go to [Tour Packages] on this Path: https://website/packages
3. Choose any package and click [Explore] Path: https://website/package/6
4. Scroll Down to the [Comments] section
5. Inject your XSS Payload in [Comment Box]
6. Click on [Submit]

7. Every visitor to the page where you inject your [XSS Payload] - Path: https://website/package/6
8. XSS will fire and execute on his browser.

[-] Done