SEC Consult SA-20261023-0 :: Multiple Cross-Site Scripting Vulnerabilities in VertiGIS WebOrderSystem
SEC Consult Vulnerability Lab via Fulldisclosure ·
SEC Consult Vulnerability Lab Security Advisory < 20261023-0 >
=======================================================================
title: Multiple Cross-Site Scripting Vulnerabilities
product: VertiGIS WebOrderSystem (KundenManager, AuftragsManager)
vulnerable version: <=7.0.8.6
fixed version: unknown
CVE number: CVE-2026-4950, CVE-2026-4951, CVE-2026-4952
impact: medium/high
homepage:https://www.vertigis.com/
found: 2025-01-14
by: Kai Zimmermann (Office Frankfurt)
SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos business
Europe | Asia
https://www.sec-consult.com
=======================================================================
Vendor description:
-------------------
"VertiGIS creates industry-leading technology that advances spatial visibility
into assets – across industries and across the globe. Our intuitive range of
use-case-based tools can help you solve complex business challenges, leverage
spatial data in new ways and build solutions that make a difference."
Source:https://www.vertigis.com/
Business recommendation:
------------------------
The vendor did not communicate a patch for the identified vulnerabilities in
VertiGIS "WebOrderSystem" and told us that "LM Explorer" will incorporate the
fixes. Version numbers were not provided nor when the fixes were implemented.
A workaround exists for CVE-2026-4952, which should be applied while no
official fix is available. Contact the vendor fur further information
regarding fixes or hardening measures.
SEC Consult highly recommends to perform a thorough security review of the product
conducted by security professionals to identify and resolve potential further
security issues.
Vulnerability overview/description:
-----------------------------------
1) Stored Cross-Site Scripting in VertiGIS CustomerAdministration Portal (CVE-2026-4950)
The VertiGIS CustomerAdministration portal (KundenManager) allows privileged
users to manage the employees (users) of defined companies (user groups). An
authenticated attacker with access to the CustomerAdministration portal can
insert malicious JavaScript code in a user's properties while editing the user.
The inserted code will be executed if other privileged users visit either the
user entry directly or the user overview of the specific user group.
2) Reflected Cross-Site Scripting in VertiGIS CustomerAdministration Portal (CVE-2026-4951)
The VertiGIS CustomerAdministration portal (KundenManager) allows privileged
users to search for employees (users) across all defined companies (user groups).
The search parameter "searchValue" can be embedded in the URL, so that if a
privileged user that is currently logged into the CustomerAdministration portal
visits that URL, the search will be performed. An unauthenticated attacker with
knowledge about the URL structure can craft a URL containing malicious
JavaScript code in the "searchValue" parameter. The inserted code will be
executed if the target privileged user visits the crafted URL while already
being logged into the CustomerAdministration portal.
3) Stored Cross-Site Scripting in VertiGIS OrderAdministration Portal (CVE-2026-4952)
The VertiGIS "ASMobile" web interface, which is part of the software package
"GIS Portal", allows authenticated users to define a business reference. An
attacker can insert malicious JavaScript code inside the business reference.
Initially this issue affects the "ASMobile" web interface as what is considered
a "self-xss". However, when placing orders through the web interface, the malicious
business reference will be included in the order details and will later be shown
in the OrderAdministration portal (AuftragsManager). The inserted JavaScript code
will be executed if a high privileged user with access to the OrderAdministration
portal visits the order that contains the attacker's malicious business reference.
Proof of concept:
-----------------
1) Stored Cross-Site Scripting in VertiGIS CustomerAdministration Portal (CVE-2026-4950)
When editing an existing user of a user group through the CustomerAdministration
portal, the following request, including malicious JavaScript code in the
"secondName" parameter, can be sent when saving the changes:
--------------------------------------------------------------------------------
[ PoC removed ]
--------------------------------------------------------------------------------
After saving the changes, the JavaScript code will be executed immediately after
the editing page, as can be seen in figure 1 below:
[01_stored_xss_01.png]
Figure 2 below shows that the JavaScript code will also be executed when a user
visits the user overview of the edited user's user group:
[02_stored_xss_02.png]
2) Reflected Cross-Site Scripting in VertiGIS CustomerAdministration Portal (CVE-2026-4951)
An unauthenticated attacker with knowledge about the CustomerAdministration portal's
URL structure can craft the following URL, which contains malicious JavaScript code
in the "searchValue" parameter:
--------------------------------------------------------------------------------
[ PoC removed ]
--------------------------------------------------------------------------------
When a privileged user, who is currently logged into the CustomerAdministration
portal, visits the crafted URL, the included JavaScript code will be executed, as
can be seen in figure 3 below:
[03_reflected_xss.png]
Potential further impacts may arise from the fact that administrative users can
change other user's (including other administrators) passwords without specifying
the old password. An attacker may be able to craft a URL loading a remote script
that performs a password reset, allowing to either take over specific accounts
or lock out other users entirely from the application.
3) Stored Cross-Site Scripting in VertiGIS OrderAdministration Portal (CVE-2026-4952)
product of "3A Web").
2025-02-19: Clarifying the opinion regarding the criticality of the instances to the
vendor and asking for an estimated timeline regarding the hardening
of the KundenManager.
2025-02-24: Vendor gives further insights and opinion on the instances.
2025-02-26: Adding a new vulnerability to this advisory, which was previously
considered a "self-XSS" but confirmed by the vendor to be exploitable in
another component.
Asking vendor to confirm the names of the affected software components.
Also asking for a timeline for when all instances are planned to be
remediated.
Vendor confirms that both, the KundenManager und AuftragsManager, are part
of the WebOrderSystem installation.
Vendor cannot give an estimated timeline yet, on when the instances will
be remediated.
2025-02-28: Asking vendor to confirm existing contact for sending updated
security advisory.
2025-03-12: Vendor confirms existing communication channel.
Sending updated security advisory.
2025-05-21: Asking for a status update.
2025-05-22: Vendor still can not provide an estimated timeline for remediation.
The instances are planned to be addressed with the release of "LM Explorer".
2026-03-26: Asking for a status update.
2026-03-27: Reserving CVEs.
2026-04-13: Vendor provides general security announcement links for "3A" and "VertiGIS LM"
that do not include information on any of the vulnerabilities from this advisory.
Asking vendor to explain the relationship between the "WebOrderSystem" component
and "3A Web" and if this component is relevant in "LM Explorer" at all, as there
are no separate announcements for "WebOrderSystem".
No response.
2026-10-15: Informing vendor that our advisory will be published the following week;
No response
2026-10-23: Release of security advisory.
Solution:
---------
The vendor did not communicate a patch for the identified vulnerabilities in
VertiGIS "WebOrderSystem" and told us that "LM Explorer" will incorporate the
fixes. Version numbers were not provided nor when the fixes were implemented.
Contact the vendor fur further information regarding fixes or hardending
measures.
Furthermore, the vendor recommends following their product announcements:
https://support.vertigis.com/hc/de/sections/4403356759570-Ank%C3%BCndigungen
https://support.vertigis.com/hc/de/sections/23916902893458-Ank%C3%BCndigungen
https://support.vertigis.com/hc/de/sections/26551407185810-Ank%C3%BCndigungen
Workaround:
-----------
- CVE-2026-4950: None
- CVE-2026-4951: None
- CVE-2026-4952: In the current version (as of 2025-02-24) it is already possible to
define an optional regular expression for the business reference. This
can also act as an input validation for Cross-Site Scripting.
Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos business
Europe | Asia
About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Atos business. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your applicationhttps://sec-consult.com/career/
Interested in improving your cyber security with the experts of SEC Consult?
Contact our local officeshttps://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mail: security-research at sec-consult dot com
Web:https://www.sec-consult.com
Blog:https://blog.sec-consult.com
X:https://x.com/sec_consult
EOF Kai Zimmermann / @2026
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/