Stored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystem
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
The VertiGIS WebOrderSystem, specifically its OrderAdministration portal (AuftragsManager) and the related ASMobile web interface within the GIS Portal package, is affected. An attacker with a normal user account can plant malicious scripts in a business reference field that later run in the browser of a highly privileged administrator who opens the order, potentially letting the attacker act with that administrator's access.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inserted into this field. On its own this only affects the user who entered it (self-XSS). However, the business reference is included in the order details when the user places an order through the web interface. The order is later listed in the OrderAdministration portal (AuftragsManager) of VertiGIS WebOrderSystem, where the stored code is executed as soon as a highly privileged user opens the order. Version 7.0.8.6 of WebOrderSystem, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- VertiGIS Ltd. WebOrderSystem (AuftragsManager)
through 7.0.8.6