This vulnerability involves improper input sanitization in the search-autootaxi.php endpoint of the ATSMS web application, leading to stored cross-site scripting (CWE-79). Malicious JavaScript code injected by an attacker is stored on the backend and executed when the affected report page is accessed by users or administrators. This can result in exfiltration of session cookies, hijacking of user sessions, and unauthorized actions performed in the context of the victim's browser. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, user interaction, and partial impact on confidentiality and integrity without availability impact.

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of users or administrators accessing the affected page. This can lead to theft of session cookies, session hijacking, and unauthorized actions performed with the victim's privileges within the application. The impact is limited to confidentiality and integrity with no direct availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected report page to trusted users only and consider implementing web application firewall (WAF) rules to detect and block malicious input patterns targeting the search-autootaxi.php endpoint. Avoid clicking on suspicious links or submitting untrusted input to the vulnerable form field.