CVE-2026-4950 in WebOrderSystem
Summary
by MITRE • 10/23/2026
The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies (user groups). User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and executed in the browser of any other privileged user who opens the edited user entry or the user overview of the corresponding user group. An authenticated attacker with access to the portal can use this to run script code in the session of other portal users. Version 7.0.8.6, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The VertiGIS WebOrderSystem CustomerAdministration portal, also known as KundenManager, contains a critical stored cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript code within the browser sessions of other privileged users. This security flaw resides in the user management functionality where administrators can edit employee properties for defined companies or user groups. Specifically, input fields such as the secondName parameter fail to properly sanitize or encode special characters before storage and subsequent rendering. When a malicious actor with administrative privileges modifies a user profile by injecting JavaScript payloads into these text fields, the system stores this untrusted data directly in its database without adequate validation against script injection patterns.
The operational impact of this vulnerability is significant because it enables session hijacking, credential theft, or unauthorized actions performed under the context of other administrators. When another privileged user accesses the edited user entry or views the overview page for that specific user group, their browser retrieves and renders the stored payload. Since the content originates from a trusted domain within the same origin policy scope, the injected script executes with full privileges associated with the victim's session. This allows an attacker to bypass standard access controls by manipulating the DOM of other users' interfaces or stealing sensitive information such as authentication tokens displayed on screen or captured via keylogging scripts embedded in the payload.
From a classification perspective, this vulnerability aligns closely with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The specific nature of storing malicious content for later execution by other users categorizes it further under Stored XSS rather than reflected or DOM-based variants. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques involving client-side code injection and potentially credential harvesting through browser session manipulation. Attackers can leverage this capability to escalate their influence within the administrative hierarchy if they compromise one account with limited privileges that still allows access to user editing features.
Mitigation strategies should focus on implementing strict input validation and output encoding mechanisms across all user-facing forms in the CustomerAdministration portal. Developers must ensure that any data entered into text fields is encoded using context-appropriate methods such as HTML entity encoding before being rendered in the browser interface. Additionally, deploying a Content Security Policy header can help mitigate the impact of successful injections by restricting script execution sources and preventing inline scripts from running unless explicitly allowed through nonces or hashes. Upgrading to patched versions provided by VertiGIS is essential for resolving this issue permanently until such updates are available. Organizations relying on this system should also monitor administrative logs for unusual changes to user profiles that might indicate exploitation attempts in progress.