Design/Logic Flaw

PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter...