CVE-2026-4952 in WebOrderSystem
Summary
by MITRE • 10/23/2026
The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inserted into this field. On its own this only affects the user who entered it (self-XSS). However, the business reference is included in the order details when the user places an order through the web interface. The order is later listed in the OrderAdministration portal (AuftragsManager) of VertiGIS WebOrderSystem, where the stored code is executed as soon as a highly privileged user opens the order. Version 7.0.8.6 of WebOrderSystem, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in the VertiGIS GIS Portal and associated WebOrderSystem components represents a classic case of stored cross-site scripting that escalates from a self-XSS issue to a privileged code execution risk due to improper data handling across application modules. The ASMobile web interface, which serves as an entry point for authenticated users within the VertiGIS ecosystem, permits the input of business references without adequate sanitization or encoding of JavaScript content. While this initial flaw technically constitutes a stored cross-site scripting vulnerability where the malicious payload is saved on the server and executed only when the victim user views their own data, the architecture of the system allows for lateral movement of risk to higher-privileged accounts. The critical failure lies in the fact that the unsanitized business reference field is propagated into order details during the ordering process and subsequently rendered without validation in the OrderAdministration portal, known as AuftragsManager.
This architectural flaw transforms a low-severity self-XSS issue into a high-severity vulnerability affecting system administrators or other privileged users who access the order management interface. When an authenticated user with lower privileges submits an order containing malicious JavaScript within the business reference field, that code is persisted in the database and displayed to authorized personnel viewing the order details. Upon opening such an order, the browser executes the injected script in the context of the privileged session. This allows an attacker who has access to any standard user account to execute arbitrary JavaScript commands with the privileges of a system administrator or other high-privilege role within the VertiGIS WebOrderSystem environment. The impact includes potential unauthorized data exfiltration, session hijacking, administrative action manipulation, and complete compromise of the GIS portal infrastructure depending on the capabilities granted by the executed script.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). Specifically, it falls under stored XSS where malicious scripts are permanently stored within target servers such as databases or message boards and later executed when users request information from the server. In terms of offensive security frameworks, this attack vector maps to ATT&CK technique T1059.007, which covers JavaScript execution on client-side browsers. The exploitation chain relies on social engineering or account compromise at a lower privilege level followed by waiting for a privileged user to view specific data, making it a persistent threat that does not require real-time interaction during the initial injection phase.
Mitigation strategies must focus on implementing robust input validation and output encoding across all stages of the application lifecycle. Developers should enforce strict allow-listing or rigorous sanitization of HTML content in the business reference field at the point of entry to prevent script tags, event handlers, and other executable JavaScript constructs from being stored. Furthermore, context-aware output encoding must be applied when rendering data in both the ASMobile interface and the OrderAdministration portal to ensure that any special characters are escaped appropriately before being interpreted by the browser. Implementing Content Security Policy headers can also provide an additional layer of defense by restricting the sources from which scripts can be loaded or executed. Regular security audits focusing on cross-module data flow integrity are essential to identify similar propagation paths where user-controlled input is rendered in privileged contexts without adequate sanitization.