Vehicle Management System Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Vehicle Management System version 1.0. The issue resides in the 'Name' parameter of the 'booking.php' file within the vehicle management module. This vulnerability allows attackers to inject malicious scripts that are executed when an administrator views the booking list on 'bookinglist.php'. Such exploitation could lead to session hijacking or unauthorized access to administrative accounts.

Impact

Exploitation of this vulnerability allows for the execution of arbitrary JavaScript in the context of the administrator's session, potentially leading to session hijacking through stolen cookies, unauthorized actions, or privilege escalation.

Reproduction

To reproduce this vulnerability, a guest user must input a payload into the 'Name' parameter on the 'booking.php' page. Despite a potential SQL injection error during submission, the payload will be stored and executed when an admin views the 'bookinglist.php' page. Example payloads include one that hijacks an admin session by stealing cookies, or another that triggers an alert without needing cookies.

Remediation

Users are advised to sanitize and encode user input for all parameters, particularly the 'Name' parameter. Implementing a Content Security Policy (CSP) to restrict script execution is also recommended. If a patched version is available, users should update to it.