LiveActive security incident?Get immediate response
CVE Record

CVE-2022-2291: SourceCodester Hotel Management System Search search cross site scripting

A vulnerability was found in SourceCodester Hotel Management System 2.0. It has been rated as problematic. This issue affects some unknown processing of the file /ci_hms/search of the component Search. The manipulation of the argument search with the input "><script>alert("XSS")</script> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

MediumCVSS 4.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-2291 is a reflected cross-site scripting issue in SourceCodester Hotel Management System 2.0. A malicious search value can cause script execution in a victim's browser if they interact with a crafted request. This is not listed in KEV, so active exploitation is not established by the provided sources.

Executive priority

Treat as a moderate web-application risk. Prioritize remediation for public-facing hotel management portals, especially where staff authenticate in browsers. The issue is unlikely to be business-critical alone, but it can support phishing, session abuse, or content tampering workflows.

Technical view

The flaw is CWE-79 in the Search component at /ci_hms/search, where the search argument is not safely handled. CVSS 3.1 is 4.3: network reachable, low complexity, no privileges, user interaction required, unchanged scope, low integrity impact, and no confidentiality or availability impact.

Likely exposure

Exposure is limited to organizations running SourceCodester Hotel Management System 2.0 with the search route reachable by users or the internet. Public-facing deployments carry higher practical risk because attackers can distribute crafted links externally.

Exploitation context

The sources state that exploit details were publicly disclosed and may be used. They do not show CISA KEV listing or confirmed active exploitation. Successful impact depends on getting a user to interact with a crafted search request.

Researcher notes

The record identifies reflected XSS in the search parameter and cites public disclosure. Affected version evidence is specific to SourceCodester Hotel Management System 2.0. The provided sources do not name a vendor patch, fixed version, or confirmed exploitation campaign.

Mitigation direction

  • Check SourceCodester or maintainer guidance for an update or official fix.
  • Encode or sanitize reflected search input before rendering it in responses.
  • Restrict public access to the application if it is not meant to be internet-facing.
  • Add browser-side defenses such as a restrictive Content Security Policy where feasible.
  • If no maintained fix exists, isolate or replace the affected application.

Validation and detection

  • Inventory deployments for SourceCodester Hotel Management System version 2.0.
  • Confirm whether /ci_hms/search is reachable from untrusted networks.
  • Review search handling for unsafe reflection of user-controlled input.
  • Run authorized XSS regression testing with non-executing markers only.
  • Review web logs or WAF events for suspicious search parameter activity.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-2291 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.3CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N2.81.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

4.3Medium
CVSS 3.1 vector shape for CVE-2022-2291Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
SourceCodesterHotel Management System2.0Listed
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.