The Vehicle Showroom Management System version 1.0 contains a cross-site scripting vulnerability in the /BranchManagement/ServiceAndSalesReport.php file. Specifically, the BRANCH_ID parameter is not properly sanitized, enabling remote attackers to inject and execute arbitrary scripts in users' browsers. The vulnerability requires no privileges and no user interaction beyond visiting a crafted URL. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, but requiring user interaction and limited impact on confidentiality and integrity. No official patch or vendor remediation level is documented, and the exploit code has been publicly disclosed.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript in the context of the affected web application for users who visit a maliciously crafted URL. This can lead to theft of session cookies, defacement, or redirection to malicious sites. The impact is limited to client-side effects and does not directly compromise server confidentiality, integrity, or availability. No evidence of active exploitation in the wild has been reported.

No official patch or remediation is currently available from the vendor. Users and administrators should monitor the vendor's advisory channels for updates. Until a fix is released, it is recommended to apply web application firewall (WAF) rules to detect and block malicious input targeting the BRANCH_ID parameter. Additionally, restricting user input and implementing input validation or output encoding on the affected parameter can reduce risk. Avoid clicking on untrusted links that may exploit this vulnerability.