| タイトル | onSite internet GmbH Auktion:NG Auktionssoftware Unknown Cross Site Scripting |
|---|
| 説明 | A reflected Cross-Site Scripting vulnerability was identified in the Auktion:NG Auktionssoftware deployment at auction.venta24.de. The issue affects the public password reset endpoint /forgotpasswd.html and is triggered through the email parameter. When form validation fails, the submitted email value is reflected into the value attribute of an HTML input field without proper context-aware encoding. By injecting a double quote, an attacker can break out of the attribute and add attacker-controlled attributes, such as JavaScript event handlers.
The vulnerability does not require authentication and was confirmed in the validation error path using an intentionally invalid CAPTCHA value, so no password reset was completed. Successful exploitation could allow JavaScript execution in a victim's browser under the trusted auction.venta24.de origin, enabling phishing, UI manipulation, access to non-HttpOnly page data, or same-origin actions with the victim's active session. The exact Auktion:NG product version was not disclosed by the tested public pages or HTTP responses; the issue was confirmed on the public production deployment on 2026-07-22. |
|---|
| ソース | ⚠️ https://github.com/CSDVi/cve/issues/5 |
|---|
| ユーザー | david_12 (UID 99465) |
|---|
| 送信 | 2026年07月22日 09:20 (2 月 ago) |
|---|
| モデレーション | 2026年09月22日 21:57 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 408708 [onSite internet GmbH Auktion NG Auktionssoftware 迄 20260722 Public Password Reset Endpoint /forgotpasswd.html email クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|