EIP-2026-107651

PRE-CVE

Hotel Management System 1.0 - Cross-Site Scripting (XSS) Arbitrary File Upload Remote Code Execution (RCE)

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-107651. PoCs published by Merbin Russel.

AI-analyzed exploit summary This exploit leverages a Blind Cross-Site Scripting (BXSS) vulnerability to steal an admin's session cookie, then uses that session to upload a PHP reverse shell for Remote Code Execution (RCE). It requires admin interaction to trigger the BXSS payload.

Description

Hotel Management System 1.0 - Cross-Site Scripting (XSS) Arbitrary File Upload Remote Code Execution (RCE)

Exploits (1)

exploitdb WORKING POC

by Merbin Russel · pythonwebappsphp

https://www.exploit-db.com/exploits/50173

View Code ZIP pw:eip

This exploit leverages a Blind Cross-Site Scripting (BXSS) vulnerability to steal an admin's session cookie, then uses that session to upload a PHP reverse shell for Remote Code Execution (RCE). It requires admin interaction to trigger the BXSS payload.

Classification

Working Poc 95%

Attack Type

Xss | Rce

Complexity

Moderate

Reliability

Reliable

Target: Hotel Management System 1.0

No auth needed

Prerequisites: Admin must visit the injected BXSS payload · Attacker must host a listener for session theft and reverse shell

MITRE ATT&CK

T1189 - Drive-by Compromise T1059 - Command and Scripting Interpreter T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026