Executive brief
PHPGurukul Auto Taxi Stand Management System (ATSMS) is a web application used to manage taxi stand operations and reporting. A security flaw in the search functionality allows an attacker to inject malicious scripts that are stored on the server. If an administrator or another user views the affected report, the attacker could steal login sessions, access sensitive data, or perform unauthorized actions on behalf of the victim.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in PHPGurukul Auto Taxi Stand Management System (ATSMS) 1.0 within the search-autootaxi.php endpoint. The root cause is a failure to sanitize user-supplied input submitted through form fields, which is subsequently stored in the backend database. An attacker with low-level privileges can inject arbitrary JavaScript payloads that execute when an administrator or another user accesses the affected report page. Successful exploitation allows for session cookie exfiltration, session hijacking, and unauthorized actions in the victim's browser context. Mitigation requires implementing output encoding for all user-supplied data and enforcing strict input validation.
Affected products
- PHPGurukul Auto Taxi Stand Management System (ATSMS) 1.0
Timeline
- 2025-09-16: advisory: NVD publication date
- 2025-09-16: disclosed: Initial discovery and disclosure by Nandana C P