CVE-2025-10794: Car Rental Project XSS Vulnerability

CVE-2025-10794 Overview

CVE-2025-10794 is a reflected Cross-Site Scripting (XSS) vulnerability affecting PHPGurukul Car Rental Project 3.0. The flaw resides in the /carrental/search.php script, where the autofocus argument is not properly sanitized before being reflected in the response. An unauthenticated remote attacker can craft a malicious URL that, when opened by a victim, executes arbitrary JavaScript in the victim's browser session. The weakness is tracked under CWE-79. Public disclosure indicates the exploit technique has been published, increasing the likelihood of opportunistic abuse against exposed instances.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser, enabling session token theft, phishing overlays, and unauthorized actions on behalf of authenticated users.

Affected Products

PHPGurukul Car Rental Project 3.0
Deployments exposing /carrental/search.php to untrusted networks
Web applications relying on the vulnerable autofocus parameter handling

Discovery Timeline

2025-09-22 - CVE-2025-10794 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10794

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the search functionality of PHPGurukul Car Rental Project 3.0. The search.php endpoint accepts an autofocus argument from the HTTP request and renders it back into the HTML response without adequate encoding or sanitization. An attacker who supplies HTML or JavaScript payloads through this parameter causes the browser to parse and execute that content in the origin of the vulnerable application.

Exploitation requires user interaction, since the victim must click a crafted link or visit an attacker-controlled page that triggers the request. Once the payload executes, it runs with the privileges of the current session, giving the attacker access to cookies, DOM contents, and any authenticated actions available to the user. The EPSS probability of 0.412% places this vulnerability in a lower exploit-likelihood tier, but public exploit details raise practical risk for internet-exposed installations.

Root Cause

The root cause is missing output encoding on user-controlled input. The application echoes the autofocus query parameter directly into the HTML response context. Because no HTML-entity encoding, contextual escaping, or input validation is applied, characters such as <, >, ", and ' retain their special meaning and break out of the intended attribute or element context.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker crafts a URL such as /carrental/search.php?autofocus=<payload> and delivers it through email, chat, or a malicious website. When a victim loads the URL, the injected script executes in the browser. Typical outcomes include session hijacking through cookie exfiltration, credential harvesting via injected forms, and forced browser actions against the vulnerable application.

No verified proof-of-concept code is republished here. Technical details are available in the GitHub CVE Issue Tracker and the VulDB entry #325151.

Detection Methods for CVE-2025-10794

Indicators of Compromise

HTTP requests to /carrental/search.php containing autofocus= values that include <script>, onerror=, javascript:, or encoded variants such as %3Cscript%3E.
Web server access logs showing unusually long or URL-encoded autofocus query parameters originating from external referrers.
Browser telemetry reporting script execution originating from the Car Rental Project origin but referencing external domains for data exfiltration.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the autofocus parameter on the search.php endpoint for HTML tags and JavaScript event handlers.
Correlate access logs with outbound DNS or HTTP requests to unfamiliar domains shortly after a user's session interacts with search.php.
Run authenticated dynamic application security testing (DAST) scans against the search endpoint using XSS payload libraries.

Monitoring Recommendations

Enable centralized logging of HTTP query strings for the Car Rental Project web tier and alert on payload patterns matching common XSS signatures.
Monitor for anomalous session activity such as concurrent logins from disparate geographies following clicks on external referrers.
Track user-reported phishing or unexpected redirects that reference the application's domain.

How to Mitigate CVE-2025-10794

Immediate Actions Required

Restrict public exposure of the /carrental/search.php endpoint until a fix is applied, using network ACLs or an authenticating reverse proxy.
Deploy WAF signatures that block HTML tags and JavaScript event handlers in the autofocus parameter.
Instruct users to avoid clicking untrusted links referencing the Car Rental Project application.

Patch Information

No vendor patch is listed in the referenced advisories at time of writing. Administrators should monitor the PhpGurukul website for updated releases. Until a patched version is available, apply compensating controls such as WAF filtering, output encoding at a reverse proxy layer, and a strict Content Security Policy (CSP) that disallows inline script execution.

Workarounds

Add server-side input validation that rejects any autofocus value containing characters outside a strict allowlist such as [A-Za-z0-9_-].
Apply HTML-entity encoding to the autofocus value before it is rendered in the response, using PHP's htmlspecialchars($value, ENT_QUOTES, 'UTF-8').
Enforce a Content Security Policy header that blocks inline scripts and restricts script sources to trusted origins.

bash

# Example Apache configuration to add a restrictive Content Security Policy
<VirtualHost *:443>
    ServerName carrental.example.com
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</VirtualHost>