Design/Logic Flaw

Online Ticket Booking has XSS via the admin/manageownerlist.php contact parameter...