CVE-2025-57145

A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application. The application fails to properly sanitize user input submitted through a form field, allowing an attacker to inject arbitrary JavaScript code. The malicious payload is stored in the backend and executed when a user or administrator accesses the affected report page. This allows attackers to exfiltrate session cookies, hijack user sessions, and perform unauthorized actions in the context of the victims browser.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/nandanacp/CVE-Collection/blob/main/CVE-2025-57145/README.md	Third Party Advisory
https://github.com/nandanacp/CVE-Collection/blob/main/CVE-2025-57145/README.md	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:phpgurukul:auto_taxi_stand_management_system:1.0:*:*:*:*:*:*:*

History

07 Nov 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de cross-site scripting (XSS) existe en el endpoint search-autootaxi.php de la aplicación web ATSMS. La aplicación no logra sanear correctamente la entrada del usuario enviada a través de un campo de formulario, permitiendo a un atacante inyectar código JavaScript arbitrario. La carga útil maliciosa se almacena en el backend y se ejecuta cuando un usuario o administrador accede a la página de informe afectada. Esto permite a los atacantes exfiltrar cookies de sesión, secuestrar sesiones de usuario y realizar acciones no autorizadas en el contexto del navegador de las víctimas.

Information

Published : 2025-09-16 15:15

Updated : 2026-11-07 18:10

NVD link : CVE-2025-57145

Mitre link : CVE-2025-57145

CVE.ORG link : CVE-2025-57145

JSON object : View

Products Affected

phpgurukul

auto_taxi_stand_management_system

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-57145", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-57145", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-16T18:28:09.825258Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-09-16T15:15:46.083", "references": [{"url": "https://github.com/nandanacp/CVE-Collection/blob/main/CVE-2025-57145/README.md", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/nandanacp/CVE-Collection/blob/main/CVE-2025-57145/README.md", "tags": ["Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application. The application fails to properly sanitize user input submitted through a form field, allowing an attacker to inject arbitrary JavaScript code. The malicious payload is stored in the backend and executed when a user or administrator accesses the affected report page. This allows attackers to exfiltrate session cookies, hijack user sessions, and perform unauthorized actions in the context of the victims browser."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting (XSS) existe en el endpoint search-autootaxi.php de la aplicaci\u00f3n web ATSMS. La aplicaci\u00f3n no logra sanear correctamente la entrada del usuario enviada a trav\u00e9s de un campo de formulario, permitiendo a un atacante inyectar c\u00f3digo JavaScript arbitrario. La carga \u00fatil maliciosa se almacena en el backend y se ejecuta cuando un usuario o administrador accede a la p\u00e1gina de informe afectada. Esto permite a los atacantes exfiltrar cookies de sesi\u00f3n, secuestrar sesiones de usuario y realizar acciones no autorizadas en el contexto del navegador de las v\u00edctimas."}], "lastModified": "2026-11-07T18:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpgurukul:auto_taxi_stand_management_system:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "648B1D5F-AA67-4CA8-BFE0-1445B12A4DD8"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}