Design/Logic Flaw

Online Ticket Booking has XSS via the admin/sitesettings.php keyword parameter...