CVE-2026-4952: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in VertiGIS Ltd. WebOrderSystem (AuftragsManager)

The vulnerability exists in the ASMobile web interface of VertiGIS WebOrderSystem (AuftragsManager), where authenticated users can insert JavaScript code into a business reference field. While this self-XSS affects only the inputting user initially, the malicious script is stored and later executed in the OrderAdministration portal when a highly privileged user views the order details. This stored cross-site scripting (CWE-79) flaw affects version 7.0.8.6 and earlier. The vendor has not disclosed any patch or fixed versions, and no known exploits are reported in the wild.

An attacker with authenticated access can inject JavaScript code that executes in the context of privileged users when they view order details. This could lead to unauthorized actions performed with elevated privileges or theft of sensitive information accessible to those users. The impact is limited to authenticated users and requires interaction by a privileged user to trigger the payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the ASMobile interface and the OrderAdministration portal to trusted users only. Educate users about the risks of entering untrusted input and consider implementing input validation or output encoding as a temporary mitigation.