SourceCodester Vehicle Management System confirmbooking.php क्रॉस साइट स्क्रिप्टिंग

Successful exploitation of CVE-2025-2377 allows an attacker to inject arbitrary JavaScript code into the Vehicle Management System. This could lead to session hijacking, defacement of the application, or redirection of users to malicious websites. The attacker could potentially steal sensitive information, such as user credentials or vehicle data, depending on the application's functionality and data handling practices. While the CVSS score is LOW, the ease of remote exploitation and potential for user interaction makes it a concerning issue, particularly for systems with limited security controls.

Organizations utilizing SourceCodester Vehicle Management System, particularly those with publicly accessible instances or those lacking robust input validation practices, are at risk. Shared hosting environments where multiple users share the same server are also at increased risk, as a compromised user account could be leveraged to exploit this vulnerability.

• php / web:

curl -I 'http://your-vehicle-management-system/confirmbooking.php?id=<script>alert(1)</script>' | grep -i 'content-type'

• php / web: Examine /confirmbooking.php for lack of input validation on the 'id' parameter. • generic web: Monitor access logs for unusual requests to /confirmbooking.php with suspicious parameters.

1. 2025-03-17Disclosure

   disclosure

1. आरक्षित2025-03-16
2. प्रकाशित2025-03-17
3. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2025-2377 is to upgrade to version 1.0.1 of the SourceCodester Vehicle Management System. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the /confirmbooking.php page to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Review and harden all other input points to prevent similar vulnerabilities.