Security Bug(Cross Site Scripting)

[chirayu-parmar]

Describe the bug
The website is having a security vulnerability. This could potentially put user accounts at risk, and allow malicious activities to take place. I have attached the screenshots of performing Cross-Site Scripting "<script>alert("ATTACK")</script>" on text input boxes.

Steps to reproduce the behavior:

1. Go to National Ticket Booking Spot
2. Type <script>alert("ATTACK")</script> in Train Number text box
3. alert box will pop up (bug).

Expected behavior
The website should not allow any type Cross-Site Scripting injection. However, it allowed the Cross-Site Scripting injection and an alert box appeared (bug).

Screenshots