Executive brief
A security vulnerability exists in the Vehicle Showroom Management System, a web application used for managing automotive dealership operations. An attacker can inject malicious scripts into the system's reporting features, which could lead to the theft of user session data or unauthorized actions being performed in a user's browser. This could compromise the privacy of dealership staff and the integrity of the management platform.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the '/BranchManagement/ProfitAndLossReport.php' component of code-projects Vehicle Showroom Management System 1.0. The root cause is the improper neutralization of user-supplied input within the 'BRANCH_ID' parameter before it is rendered in the web page. A remote, unauthenticated attacker can exploit this by tricking a user into clicking a specially crafted link containing a malicious payload. Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking (cookie theft) or unauthorized page manipulation. A public exploit (PoC) has been disclosed.
Affected products
- code-projects Vehicle Showroom Management System 1.0
Timeline
- 2026-04-03: disclosed: Vulnerability details and PoC published on GitHub.
- 2026-04-10: advisory: CVE-2026-6034 published.