| Título | onSite internet GmbH Auktion:NG Auktionssoftware Unknown Cross Site Scripting |
|---|
| Descripción | A reflected Cross-Site Scripting vulnerability was identified in the Auktion:NG Auktionssoftware deployment at auction.venta24.de. The issue affects the public password reset endpoint /forgotpasswd.html and is triggered through the email parameter. When form validation fails, the submitted email value is reflected into the value attribute of an HTML input field without proper context-aware encoding. By injecting a double quote, an attacker can break out of the attribute and add attacker-controlled attributes, such as JavaScript event handlers.
The vulnerability does not require authentication and was confirmed in the validation error path using an intentionally invalid CAPTCHA value, so no password reset was completed. Successful exploitation could allow JavaScript execution in a victim's browser under the trusted auction.venta24.de origin, enabling phishing, UI manipulation, access to non-HttpOnly page data, or same-origin actions with the victim's active session. The exact Auktion:NG product version was not disclosed by the tested public pages or HTTP responses; the issue was confirmed on the public production deployment on 2026-07-22. |
|---|
| Fuente | ⚠️ https://github.com/CSDVi/cve/issues/5 |
|---|
| Usuario | david_12 (UID 99465) |
|---|
| Sumisión | 2026-07-22 09:20 (hace 2 meses) |
|---|
| Moderación | 2026-09-22 21:57 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 408708 [onSite internet GmbH Auktion NG Auktionssoftware hasta 20260722 Public Password Reset Endpoint /forgotpasswd.html email secuencias de comandos en sitios cruzados] |
|---|
| Puntos | 20 |
|---|