VertiGIS WebOrderSystem 7.0.8.6 Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory < 20261023-0 >
=======================================================================
               title: Multiple Cross-Site Scripting Vulnerabilities
             product: VertiGIS WebOrderSystem (KundenManager, AuftragsManager)
  vulnerable version: <=7.0.8.6
       fixed version: unknown
          CVE number: CVE-2026-4950, CVE-2026-4951, CVE-2026-4952
              impact: medium/high
            homepage:https://www.vertigis.com/
               found: 2025-01-14
                  by: Kai Zimmermann (Office Frankfurt)
                      SEC Consult Vulnerability Lab

                      An integrated part of SEC Consult, an Atos business
                      Europe | Asia

                      https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"VertiGIS creates industry-leading technology that advances spatial visibility
into assets – across industries and across the globe. Our intuitive range of
use-case-based tools can help you solve complex business challenges, leverage
spatial data in new ways and build solutions that make a difference."

Source:https://www.vertigis.com/


Business recommendation:
------------------------
The vendor did not communicate a patch for the identified vulnerabilities in
VertiGIS "WebOrderSystem" and told us that "LM Explorer" will incorporate the
fixes. Version numbers were not provided nor when the fixes were implemented.

A workaround exists for CVE-2026-4952, which should be applied while no
official fix is available. Contact the vendor fur further information
regarding fixes or hardening measures.

SEC Consult highly recommends to perform a thorough security review of the product
conducted by security professionals to identify and resolve potential further
security issues.


Vulnerability overview/description:
-----------------------------------
1) Stored Cross-Site Scripting in VertiGIS CustomerAdministration Portal (CVE-2026-4950)
The VertiGIS CustomerAdministration portal (KundenManager) allows privileged
users to manage the employees (users) of defined companies (user groups). An
authenticated attacker with access to the CustomerAdministration portal can
insert malicious JavaScript code in a user's properties while editing the user.
The inserted code will be executed if other privileged users visit either the
user entry directly or the user overview of the specific user group.

2) Reflected Cross-Site Scripting in VertiGIS CustomerAdministration Portal (CVE-2026-4951)
The VertiGIS CustomerAdministration portal (KundenManager) allows privileged
users to search for employees (users) across all defined companies (user groups).
The search parameter "searchValue" can be embedded in the URL, so that if a
privileged user that is currently logged into the CustomerAdministration portal
visits that URL, the search will be performed. An unauthenticated attacker with
knowledge about the URL structure can craft a URL containing malicious
JavaScript code in the "searchValue" parameter. The inserted code will be
executed if the target privileged user visits the crafted URL while already
being logged into the CustomerAdministration portal.

3) Stored Cross-Site Scripting in VertiGIS OrderAdministration Portal (CVE-2026-4952)
The VertiGIS "ASMobile" web interface, which is part of the software package
"GIS Portal", allows authenticated users to define a business reference. An
attacker can insert malicious JavaScript code inside the business reference.
Initially this issue affects the "ASMobile" web interface as what is considered
a "self-xss". However, when placing orders through the web interface, the malicious
business reference will be included in the order details and will later be shown
in the OrderAdministration portal (AuftragsManager). The inserted JavaScript code
will be executed if a high privileged user with access to the OrderAdministration
portal visits the order that contains the attacker's malicious business reference.


Proof of concept:
-----------------
1) Stored Cross-Site Scripting in VertiGIS CustomerAdministration Portal (CVE-2026-4950)
When editing an existing user of a user group through the CustomerAdministration
portal, the following request, including malicious JavaScript code in the
"secondName" parameter, can be sent when saving the changes:

--------------------------------------------------------------------------------
[ PoC removed ]
--------------------------------------------------------------------------------

After saving the changes, the JavaScript code will be executed immediately after
the editing page, as can be seen in figure 1 below:

[01_stored_xss_01.png]

Figure 2 below shows that the JavaScript code will also be executed when a user
visits the user overview of the edited user's user group:

[02_stored_xss_02.png]


2) Reflected Cross-Site Scripting in VertiGIS CustomerAdministration Portal (CVE-2026-4951)
An unauthenticated attacker with knowledge about the CustomerAdministration portal's
URL structure can craft the following URL, which contains malicious JavaScript code
in the "searchValue" parameter:

--------------------------------------------------------------------------------
[ PoC removed ]
--------------------------------------------------------------------------------

When a privileged user, who is currently logged into the CustomerAdministration
portal, visits the crafted URL, the included JavaScript code will be executed, as
can be seen in figure 3 below:

[03_reflected_xss.png]

Potential further impacts may arise from the fact that administrative users can
change other user's (including other administrators) passwords without specifying
the old password. An attacker may be able to craft a URL loading a remote script
that performs a password reset, allowing to either take over specific accounts
or lock out other users entirely from the application.


3) Stored Cross-Site Scripting in VertiGIS OrderAdministration Portal (CVE-2026-4952)
A user's business reference can be edited by the user through the "ASMobile" web interface, when being logged in. For demonstration purposes, an image HTML tag can be inserted in the reference, which, when causing an error, executes a JavaScript alert. When adding such a
payload to the business reference and exiting the text field, the JavaScript alert will be executed, as can be seen in figure 4 below: [04_stored_xss_2_alert.png] Rechecking the business reference
after exiting the alert shows that the malicious image tag was rendered inside the page, as shown in figure 5 below: [05_stored_xss_2_rendered.png] When placing orders through the web interface, the
user's business reference will also be included. After the order is placed, it will be listed in the administrative OrderAdministration portal and the malicious JavaScript code will be executed in a
high privileged browser of the victim, when it visits that order. Vulnerable / tested versions: ----------------------------- The following version has been tested which was the latest version
available at the time of the test: * WebOrderSystem (7.0.8.6) Different software components, including WebOrderSystem, GIS Portal and multiple 3A Web components, were installed on the tested system.
The vulnerabilities were associated with the WebOrderSystem. The vendor did not provide further information which exact products or versions are affected. Vendor contact timeline:
------------------------ 2025-01-30: Contacting vendor through [email protected] Received automatic response from support ticket system. Later received response from support employee, asking
on whose behalf we work. 2025-01-31: Explaining context to support contact and asking for correct security contact to send the advisory. Support contact informs that the customer already provided the
vulnerability information in the form of a report excerpt. Pointing out the Responsible Disclosure process to the support contact again. 2025-02-14: Asking for updates and the planned next steps to
remediate the vulnerabilities. 2025-02-18: Vendor provides detailed evaluation and opinion on all instances. The vendor sees the instances described in this advisory as non-critical, as access to the
CustomerAdministration portal (KundenManager) should generally be restricted to a small user group and the site is recommended to be restricted to Intranet access. However, both instances are planned
to be addressed in a separate hardening of the KundenManager during further development of the VertiGIS product "LM Explorer" (successor
             product of "3A Web").
2025-02-19: Clarifying the opinion regarding the criticality of the instances to the
             vendor and asking for an estimated timeline regarding the hardening
             of the KundenManager.
2025-02-24: Vendor gives further insights and opinion on the instances.
2025-02-26: Adding a new vulnerability to this advisory, which was previously
             considered a "self-XSS" but confirmed by the vendor to be exploitable in
             another component.
             Asking vendor to confirm the names of the affected software components.
             Also asking for a timeline for when all instances are planned to be
             remediated.
             Vendor confirms that both, the KundenManager und AuftragsManager, are part
             of the WebOrderSystem installation.
             Vendor cannot give an estimated timeline yet, on when the instances will
             be remediated.
2025-02-28: Asking vendor to confirm existing contact for sending updated
             security advisory.
2025-03-12: Vendor confirms existing communication channel.
             Sending updated security advisory.
2025-05-21: Asking for a status update.
2025-05-22: Vendor still can not provide an estimated timeline for remediation.
             The instances are planned to be addressed with the release of "LM Explorer".
2026-03-26: Asking for a status update.
2026-03-27: Reserving CVEs.
2026-04-13: Vendor provides general security announcement links for "3A" and "VertiGIS LM"
             that do not include information on any of the vulnerabilities from this advisory.
             Asking vendor to explain the relationship between the "WebOrderSystem" component
             and "3A Web" and if this component is relevant in "LM Explorer" at all, as there
             are no separate announcements for "WebOrderSystem".
             No response.
2026-10-15: Informing vendor that our advisory will be published the following week;
             No response
2026-10-23: Release of security advisory.


Solution:
---------
The vendor did not communicate a patch for the identified vulnerabilities in
VertiGIS "WebOrderSystem" and told us that "LM Explorer" will incorporate the
fixes. Version numbers were not provided nor when the fixes were implemented.
Contact the vendor fur further information regarding fixes or hardending
measures.

Furthermore, the vendor recommends following their product announcements:
https://support.vertigis.com/hc/de/sections/4403356759570-Ank%C3%BCndigungen
https://support.vertigis.com/hc/de/sections/23916902893458-Ank%C3%BCndigungen
https://support.vertigis.com/hc/de/sections/26551407185810-Ank%C3%BCndigungen


Workaround:
-----------
- CVE-2026-4950: None
- CVE-2026-4951: None
- CVE-2026-4952: In the current version (as of 2025-02-24) it is already possible to
                  define an optional regular expression for the business reference. This
                  can also act as an input validation for Cross-Site Scripting.


Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos business
Europe | Asia

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Atos business. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your applicationhttps://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local officeshttps://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: security-research at sec-consult dot com
Web:https://www.sec-consult.com
Blog:https://blog.sec-consult.com
X:https://x.com/sec_consult

EOF Kai Zimmermann / @2026