# Exploit Title: Travelable 1.0 - Stored XSS  
# Exploit Author: CraCkEr  
# Date: 15/07/2023  
# Vendor:  
# Vendor Homepage:  
# Software Link:  
# Tested on: Windows 10 Pro  
# Impact: Manipulate the content of the site  
## Description  
Allow Attacker to inject malicious code into website, give ability to steal sensitive  
information, manipulate data, and launch additional attacks.  
Path: /[random-number]/comment  
POST parameter 'comment' is vulnerable to XSS  
POST /[random-number]/comment HTTP/2  
_token=10Mh1zuuVXB1iH3QsrEOqpWGOXogEv38WPwqGtv6&name=cracker+infosec&[XSS Payload]  
## Steps to Reproduce:  
1. Surf as a (Guest User)  
2. Go to [Tour Packages] on this Path: https://website/packages  
3. Choose any package and click [Explore] Path: https://website/package/6  
4. Scroll Down to the [Comments] section  
5. Inject your XSS Payload in [Comment Box]  
6. Click on [Submit]  
7. Every visitor to the page where you inject your [XSS Payload] - Path: https://website/package/6  
8. XSS will fire and execute on his browser.  
[-] Done