Code injection

Online Ticket Booking has XSS via the admin/newsedit.php newstitle parameter...