PHPJabbers Cinema Booking System 1.0 Cross Site Scripting

`# Exploit Title: PHPJabbers Cinema Booking System v1.0 - Reflected Cross-Site Scripting  
# Date: 19/12/2023  
# Exploit Author: BugsBD Limited  
# Discover by: Rahad Chowdhury  
# Vendor Homepage: https://www.phpjabbers.com/  
# Software Link: https://www.phpjabbers.com/cinema-booking-system/#sectionDemo  
# Version: v1.0  
# Tested on: Windows 10, Windows 11, Linux  
# CVE-2023-51330  
  
  
Descriptions:  
Reflected cross-site scripting (XSS) vulnerability exists in  
Reservations menu, Schedule section and "date" parameter of PHPJabbers  
Cinema Booking System v1.0 that allows attackers to execute arbitrary  
web scripts or HTML via a crafted payload injected into the Website  
login page parameter.  
  
Steps to Reproduce:  
1. Login your panel.  
2. Go to Now Showing menu then click Print.  
3. Now use XSS Payload in "date" parameter.  
4. You will see xss popup.  
  
  
## Reproduce:  
[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51330)  
  
  
# Exploit Title: PHPJabbers Cinema Booking System v1.0 - Multiple Stored XSS  
# Date: 19/12/2023  
# Exploit Author: BugsBD Limited  
# Discover by: Rahad Chowdhury  
# Vendor Homepage: https://www.phpjabbers.com/  
# Software Link: https://www.phpjabbers.com/cinema-booking-system/#sectionDemo  
# Version: v1.0  
# Tested on: Windows 10, Windows 11, Linux  
# CVE-2023-51335  
  
Descriptions:  
PHPJabbers Cinema Booking System v1.0 is vulnerable to Multiple Stored  
Cross-Site Scripting. Multiple Stored XSS is a type of security  
vulnerability that occurs when an application or website allows an  
attacker to inject malicious scripts into the content that is  
permanently stored on the server.  
  
Steps to Reproduce:  
1. Login your panel.  
2. Vulnerable parameters are "title, name".  
3. Go to System Users Menu then click add user.  
4. Then use any XSS Payload in "Name" input field and Save.  
5. You will see xss popup.  
  
## Reproduce:  
[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51335)  
`