Finleytang

**Name of the Vulnerable Software and Affected Versions** itsourcecode Vehicle Management System version 1.0 **Description** A problem has been found in the itsourcecode Vehicle Management System, classified as problematic. This issue affects some unknown processing of the file /billaction.php. The manipulation of the `extra-cost` argument leads to cross site scripting. The attack may be initiated remotely. **Recommendations** For itsourcecode Vehicle Management System version 1.0, consider disabling access to the /billaction.php file until a patch is available. As a temporary workaround, avoid using the `extra-cost` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Vehicle Management System version 1.0 **Description** A critical issue has been found in the itsourcecode Vehicle Management System, affecting an unknown function of the file editbill.php. The manipulation of the `id` argument leads to SQL injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For itsourcecode Vehicle Management System version 1.0, as a temporary workaround, consider restricting access to the editbill.php file until a patch is available. Avoid using the `id` argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Vehicle Management System version 1.0 **Description** A critical issue has been found in the itsourcecode Vehicle Management System, affecting an unknown functionality of the file sendmail.php. The manipulation of the `id` argument leads to SQL injection. This issue can be exploited remotely. **Recommendations** For itsourcecode Vehicle Management System version 1.0, consider disabling the functionality related to the sendmail.php file until a patch is available. Restrict access to the `id` argument in the affected functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Gadget Works Online Ordering System version 1.0 **Description** A problem was found in the processing of the file /admin/products/index.php, specifically in the GET Parameter Handler component. The issue can be exploited by manipulating the `view` argument with malicious input, such as `<script>alert(666)</script>`, leading to cross-site scripting. This can be initiated remotely. **Recommendations** For SourceCodester Gadget Works Online Ordering System version 1.0, consider disabling the `view` argument in the /admin/products/index.php file as a temporary workaround until a patch is available. Restrict access to the /admin/products/index.php file to minimize the risk of exploitation. Avoid using the `view` argument in the affected API endpoint until the issue is resolved.