The vulnerability in Tobit Laboratories AG TeamDavid's Webbox application involves improper validation of the “cType” URL parameter, which allows injection of HTTP headers by including control characters such as URL-encoded newlines (%0a) or colons. This enables attackers to add extra headers, including Location headers, resulting in an open redirect (CWE-601). The affected versions include TeamDavid through Rollout 524. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

Successful exploitation allows an attacker to perform an open redirect by injecting arbitrary HTTP headers, potentially redirecting users to untrusted sites. This can be used in phishing or social engineering attacks but does not directly lead to code execution or data compromise. The vulnerability requires no privileges and no user interaction is needed beyond clicking a crafted URL.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with URLs containing the “cType” parameter in TeamDavid Webbox. No official mitigation or temporary fix has been published.