Code-Projects Online Car Rental System Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Code-Projects Online Car Rental System version 1.0. The issue arises in the admin panel, specifically within the edit-vehicle.php file. Authenticated attackers can exploit this vulnerability by injecting malicious JavaScript into the vehicalorcview parameter, which is then executed when the page is viewed.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.

Reproduction

To reproduce this vulnerability, log into the admin panel of the affected car rental system. Navigate to the 'edit vehicle' section and locate the 'vehicalorcview' parameter. Inject a JavaScript payload into this parameter and save the changes. The injected script will execute when the page is accessed, demonstrating the cross-site scripting vulnerability.