Booking.com suffers from an open redirection vulnerability.