Executive brief
A vulnerability exists in the code-projects Vehicle Showroom Management System, a web application used for managing automotive dealership operations. An attacker can inject malicious scripts into the system's reporting pages, which could lead to the theft of user session information or unauthorized actions being performed in a user's browser. This could compromise the privacy of dealership staff and the integrity of the management system.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in code-projects Vehicle Showroom Management System 1.0 within the /BranchManagement/ServiceAndSalesReport.php component. The vulnerability is caused by a failure to properly sanitize or encode the 'BRANCH_ID' input parameter before it is rendered in the web page. A remote, unauthenticated attacker can exploit this by tricking a user into clicking a specially crafted link containing a malicious payload. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking (cookie theft) or unauthorized administrative actions. Public exploit code (PoC) has been disclosed.
Affected products
- code-projects Vehicle Showroom Management System 1.0
Timeline
- 2026-04-03: disclosed: Vulnerability details and PoC published on GitHub.
- 2026-04-10: advisory: CVE-2026-6035 published.