CVE-2025-69151: Unauthenticated XSS in Grand Car Rental ≤3.7 (CVSS 7.1)

Technical summary

This vulnerability is a reflected or stored XSS flaw (CWE-79) in Grand Car Rental up to and including version 3.7. The application fails to properly sanitize or encode user-controlled input before rendering it in HTTP responses. Because the PR (Privilege Required) component is set to None, the vulnerability can be exploited by unauthenticated users. The attack has a network attack vector (AV:N) with low complexity (AC:L), meaning it requires only standard network access and no special conditions. The scope change (S:C) indicates the vulnerability can affect resources beyond the vulnerable component, such as user sessions or related web applications on the same domain.

Business impact

An attacker exploiting this XSS vulnerability could compromise user trust and data. Potential impacts include session hijacking, credential theft via phishing payloads, defacement of rental information, injection of fake booking confirmations, malware distribution, or redirection to competitor sites. For a car rental platform, this is particularly damaging because users enter personal information (driver's license details, payment methods) during the booking process. A successful attack could lead to identity theft, financial loss, regulatory penalties under data protection laws, and reputational harm that directly affects customer acquisition and retention.

Affected systems

Grand Car Rental application versions 3.7 and earlier are affected. Organizations running this software should immediately audit their deployments to identify which version is in use. The vulnerability applies to any instance accessible over the network, whether public-facing or internal. Users of Grand Car Rental should contact the vendor to confirm patch availability and timing.

Exploitability

This vulnerability is moderately exploitable because it requires user interaction (UI:R) — an attacker must socially engineer a victim into clicking a malicious link or visiting a compromised page. However, the barrier to exploitation is low: an attacker needs no special tools, can craft simple payloads, and can distribute malicious links via email, search engine poisoning, or compromised advertisements. The lack of authentication requirements and low attack complexity make this a practical threat in real-world scenarios. It is not yet tracked in CISA's Known Exploited Vulnerabilities catalog, but the ease of exploitation suggests active abuse is likely as awareness spreads.

Remediation

Upgrade Grand Car Rental to a version beyond 3.7 that includes the security patch. Verify against the vendor's official security advisory for the exact patched version. If an immediate upgrade is not possible, implement compensating controls: deploy a Web Application Firewall (WAF) with XSS filtering rules, enforce a strict Content Security Policy (CSP) header to prevent inline script execution, sanitize all user input server-side, and use output encoding appropriate to the context (HTML, URL, JavaScript, CSS). Educate users not to click suspicious links, especially those containing unusual URL parameters or unfamiliar domains.

Patch guidance

Contact Grand Car Rental for the official patched version. Verify the exact version number against the vendor's security bulletin before deployment. Test the patch in a staging environment to ensure compatibility with customizations or integrations. Apply patches during a maintenance window to minimize disruption. After patching, validate that XSS payloads no longer execute by testing with common vectors (e.g., <script>alert(1)</script> in URL parameters and form fields).

Detection guidance

Monitor web server logs for suspicious URL patterns containing script tags, JavaScript event handlers (onerror, onload, onclick), or HTML entities that decode to script content. Look for requests with unusual parameter values or high entropy strings in query parameters. Use a WAF to detect and log XSS attempts. Implement runtime application self-protection (RASP) to block script execution in the browser context. Review user session logs for unusual activity correlated with suspicious referrer headers or user-agent anomalies. Search for indicators of compromise in JavaScript console errors or unexpected DOM modifications on client-side monitoring tools.

Why prioritize this

This vulnerability merits high priority due to its CVSS score of 7.1 (HIGH), the absence of authentication requirements, and the sensitive nature of data processed by car rental applications. While user interaction is required, the low complexity and network accessibility make exploitation practical. Car rental platforms store personally identifiable information and payment data, creating significant compliance and legal liability if compromised. The lack of KEV status does not minimize risk; many XSS flaws are actively exploited before formal tracking begins. Organizations should treat this as urgent and schedule patching within days, not weeks.

Risk score, explained

The CVSS v3.1 score of 7.1 reflects a high-severity flaw with broad reach. The network attack vector (AV:N) and low complexity (AC:L) indicate low barriers to exploitation. The lack of privilege requirements (PR:N) and user interaction necessity (UI:R) balance to create a practical threat. The impact assessment—confidentiality, integrity, and availability all marked as Low (L)—suggests each attack instance causes limited damage, but the scope change (S:C) means the vulnerability can affect multiple users or connected systems. The overall score prioritizes this above medium-severity flaws but below critical remote code execution or authentication bypass vulnerabilities.

Frequently asked questions