# CVE-2026-39200 — Reflected Cross-Site Scripting (XSS) in Toko Online RotI ## Summary A reflected Cross-Site Scripting (XSS) vulnerability was identified in the `produk` request parameter of the **Toko Online RotI** web application. The application fails to HTML-encode user-supplied input before reflecting it inside an HTML tag attribute that is encapsulated in double quotation marks. An attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the context of the victim's browser session. Field| Value ---|--- **CVE ID**| CVE-2026-39200 **Vulnerability Type**| CWE-79 — Improper Neutralization of Input During Web Page Generation (Reflected XSS) **Affected Product**| Toko Online RotI (Indonesian online store) **Affected Parameter**| `produk` **Discoverer**| Uzair Ali (r00tali) — Penetration Tester / Bug Bounty Hunter **Discovery Date**| 2026-07-03 **CVE Assigned**| 2026-07-12 **Advisory Published**| 2026-07-19 * * * ## Vulnerability Details The `produk` request parameter is copied verbatim into the value of an HTML tag attribute enclosed in double quotation marks. Because the application does not HTML-encode the user-supplied input before reflecting it, an attacker can break out of the attribute by submitting a payload that contains a closing double quote followed by an HTML/JavaScript payload. ### Proof-of-Concept Payload xbnw0">skc2h When this payload is submitted as the `produk` parameter, the application echoes the input back into the response **unescaped**. The closing `">` terminates the original attribute, and the injected `` block is interpreted by the browser as a new HTML element, executing arbitrary JavaScript in the user's session. ### Vulnerable Pattern (Conceptual) The vulnerable HTML response looks like this: skc2h" /> ^^^^^^^^^^^^^^^^^^^^^^^^ Browser executes this ### HTTP Request (Reproduction) GET /[vulnerable-endpoint]?produk=xbnw0%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3Eskc2h HTTP/1.1 Host: [target-host] User-Agent: Mozilla/5.0 ### HTTP Response (Excerpt) HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 skc2h" /> * * * ## Reproduction Steps 1. Identify an endpoint in the Toko Online RotI application that reflects the `produk` parameter inside an HTML attribute (e.g., a product search, detail, or filter page). 2. Replace the `produk` parameter value with the following payload: xbnw0">skc2h 3. Submit the request to the server. 4. Inspect the server's response. The payload is echoed back unmodified inside the attribute, breaking out of the `"` and producing a valid `

Reporter	Title	Published	Views	Family All 2
Circl	CVE-2026-39200	20 Jul 202618:00	–	circl
CVE	CVE-2026-39200	20 Jul 202618:00	–	cve